Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 1991, 1992 Linus Torvalds
4 */
5
6/*
7 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
8 * or rs-channels. It also implements echoing, cooked mode etc.
9 *
10 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
11 *
12 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
13 * tty_struct and tty_queue structures. Previously there was an array
14 * of 256 tty_struct's which was statically allocated, and the
15 * tty_queue structures were allocated at boot time. Both are now
16 * dynamically allocated only when the tty is open.
17 *
18 * Also restructured routines so that there is more of a separation
19 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
20 * the low-level tty routines (serial.c, pty.c, console.c). This
21 * makes for cleaner and more compact code. -TYT, 9/17/92
22 *
23 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
24 * which can be dynamically activated and de-activated by the line
25 * discipline handling modules (like SLIP).
26 *
27 * NOTE: pay no attention to the line discipline code (yet); its
28 * interface is still subject to change in this version...
29 * -- TYT, 1/31/92
30 *
31 * Added functionality to the OPOST tty handling. No delays, but all
32 * other bits should be there.
33 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
34 *
35 * Rewrote canonical mode and added more termios flags.
36 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
37 *
38 * Reorganized FASYNC support so mouse code can share it.
39 * -- ctm@ardi.com, 9Sep95
40 *
41 * New TIOCLINUX variants added.
42 * -- mj@k332.feld.cvut.cz, 19-Nov-95
43 *
44 * Restrict vt switching via ioctl()
45 * -- grif@cs.ucr.edu, 5-Dec-95
46 *
47 * Move console and virtual terminal code to more appropriate files,
48 * implement CONFIG_VT and generalize console device interface.
49 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
50 *
51 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
52 * -- Bill Hawes <whawes@star.net>, June 97
53 *
54 * Added devfs support.
55 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
56 *
57 * Added support for a Unix98-style ptmx device.
58 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
59 *
60 * Reduced memory usage for older ARM systems
61 * -- Russell King <rmk@arm.linux.org.uk>
62 *
63 * Move do_SAK() into process context. Less stack use in devfs functions.
64 * alloc_tty_struct() always uses kmalloc()
65 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66 */
67
68#include <linux/types.h>
69#include <linux/major.h>
70#include <linux/errno.h>
71#include <linux/signal.h>
72#include <linux/fcntl.h>
73#include <linux/sched/signal.h>
74#include <linux/sched/task.h>
75#include <linux/interrupt.h>
76#include <linux/tty.h>
77#include <linux/tty_driver.h>
78#include <linux/tty_flip.h>
79#include <linux/devpts_fs.h>
80#include <linux/file.h>
81#include <linux/fdtable.h>
82#include <linux/console.h>
83#include <linux/timer.h>
84#include <linux/ctype.h>
85#include <linux/kd.h>
86#include <linux/mm.h>
87#include <linux/string.h>
88#include <linux/slab.h>
89#include <linux/poll.h>
90#include <linux/proc_fs.h>
91#include <linux/init.h>
92#include <linux/module.h>
93#include <linux/device.h>
94#include <linux/wait.h>
95#include <linux/bitops.h>
96#include <linux/delay.h>
97#include <linux/seq_file.h>
98#include <linux/serial.h>
99#include <linux/ratelimit.h>
100
101#include <linux/uaccess.h>
102
103#include <linux/kbd_kern.h>
104#include <linux/vt_kern.h>
105#include <linux/selection.h>
106
107#include <linux/kmod.h>
108#include <linux/nsproxy.h>
109
110#undef TTY_DEBUG_HANGUP
111#ifdef TTY_DEBUG_HANGUP
112# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
113#else
114# define tty_debug_hangup(tty, f, args...) do { } while (0)
115#endif
116
117#define TTY_PARANOIA_CHECK 1
118#define CHECK_TTY_COUNT 1
119
120struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
121 .c_iflag = ICRNL | IXON,
122 .c_oflag = OPOST | ONLCR,
123 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
124 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
125 ECHOCTL | ECHOKE | IEXTEN,
126 .c_cc = INIT_C_CC,
127 .c_ispeed = 38400,
128 .c_ospeed = 38400,
129 /* .c_line = N_TTY, */
130};
131
132EXPORT_SYMBOL(tty_std_termios);
133
134/* This list gets poked at by procfs and various bits of boot up code. This
135 could do with some rationalisation such as pulling the tty proc function
136 into this file */
137
138LIST_HEAD(tty_drivers); /* linked list of tty drivers */
139
140/* Mutex to protect creating and releasing a tty */
141DEFINE_MUTEX(tty_mutex);
142
143static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
144static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
145ssize_t redirected_tty_write(struct file *, const char __user *,
146 size_t, loff_t *);
147static __poll_t tty_poll(struct file *, poll_table *);
148static int tty_open(struct inode *, struct file *);
149long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
150#ifdef CONFIG_COMPAT
151static long tty_compat_ioctl(struct file *file, unsigned int cmd,
152 unsigned long arg);
153#else
154#define tty_compat_ioctl NULL
155#endif
156static int __tty_fasync(int fd, struct file *filp, int on);
157static int tty_fasync(int fd, struct file *filp, int on);
158static void release_tty(struct tty_struct *tty, int idx);
159
160/**
161 * free_tty_struct - free a disused tty
162 * @tty: tty struct to free
163 *
164 * Free the write buffers, tty queue and tty memory itself.
165 *
166 * Locking: none. Must be called after tty is definitely unused
167 */
168
169static void free_tty_struct(struct tty_struct *tty)
170{
171 tty_ldisc_deinit(tty);
172 put_device(tty->dev);
173 kfree(tty->write_buf);
174 tty->magic = 0xDEADDEAD;
175 kfree(tty);
176}
177
178static inline struct tty_struct *file_tty(struct file *file)
179{
180 return ((struct tty_file_private *)file->private_data)->tty;
181}
182
183int tty_alloc_file(struct file *file)
184{
185 struct tty_file_private *priv;
186
187 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
188 if (!priv)
189 return -ENOMEM;
190
191 file->private_data = priv;
192
193 return 0;
194}
195
196/* Associate a new file with the tty structure */
197void tty_add_file(struct tty_struct *tty, struct file *file)
198{
199 struct tty_file_private *priv = file->private_data;
200
201 priv->tty = tty;
202 priv->file = file;
203
204 spin_lock(&tty->files_lock);
205 list_add(&priv->list, &tty->tty_files);
206 spin_unlock(&tty->files_lock);
207}
208
209/**
210 * tty_free_file - free file->private_data
211 *
212 * This shall be used only for fail path handling when tty_add_file was not
213 * called yet.
214 */
215void tty_free_file(struct file *file)
216{
217 struct tty_file_private *priv = file->private_data;
218
219 file->private_data = NULL;
220 kfree(priv);
221}
222
223/* Delete file from its tty */
224static void tty_del_file(struct file *file)
225{
226 struct tty_file_private *priv = file->private_data;
227 struct tty_struct *tty = priv->tty;
228
229 spin_lock(&tty->files_lock);
230 list_del(&priv->list);
231 spin_unlock(&tty->files_lock);
232 tty_free_file(file);
233}
234
235/**
236 * tty_name - return tty naming
237 * @tty: tty structure
238 *
239 * Convert a tty structure into a name. The name reflects the kernel
240 * naming policy and if udev is in use may not reflect user space
241 *
242 * Locking: none
243 */
244
245const char *tty_name(const struct tty_struct *tty)
246{
247 if (!tty) /* Hmm. NULL pointer. That's fun. */
248 return "NULL tty";
249 return tty->name;
250}
251
252EXPORT_SYMBOL(tty_name);
253
254const char *tty_driver_name(const struct tty_struct *tty)
255{
256 if (!tty || !tty->driver)
257 return "";
258 return tty->driver->name;
259}
260
261static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
262 const char *routine)
263{
264#ifdef TTY_PARANOIA_CHECK
265 if (!tty) {
266 pr_warn("(%d:%d): %s: NULL tty\n",
267 imajor(inode), iminor(inode), routine);
268 return 1;
269 }
270 if (tty->magic != TTY_MAGIC) {
271 pr_warn("(%d:%d): %s: bad magic number\n",
272 imajor(inode), iminor(inode), routine);
273 return 1;
274 }
275#endif
276 return 0;
277}
278
279/* Caller must hold tty_lock */
280static int check_tty_count(struct tty_struct *tty, const char *routine)
281{
282#ifdef CHECK_TTY_COUNT
283 struct list_head *p;
284 int count = 0, kopen_count = 0;
285
286 spin_lock(&tty->files_lock);
287 list_for_each(p, &tty->tty_files) {
288 count++;
289 }
290 spin_unlock(&tty->files_lock);
291 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
292 tty->driver->subtype == PTY_TYPE_SLAVE &&
293 tty->link && tty->link->count)
294 count++;
295 if (tty_port_kopened(tty->port))
296 kopen_count++;
297 if (tty->count != (count + kopen_count)) {
298 tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
299 routine, tty->count, count, kopen_count);
300 return (count + kopen_count);
301 }
302#endif
303 return 0;
304}
305
306/**
307 * get_tty_driver - find device of a tty
308 * @dev_t: device identifier
309 * @index: returns the index of the tty
310 *
311 * This routine returns a tty driver structure, given a device number
312 * and also passes back the index number.
313 *
314 * Locking: caller must hold tty_mutex
315 */
316
317static struct tty_driver *get_tty_driver(dev_t device, int *index)
318{
319 struct tty_driver *p;
320
321 list_for_each_entry(p, &tty_drivers, tty_drivers) {
322 dev_t base = MKDEV(p->major, p->minor_start);
323 if (device < base || device >= base + p->num)
324 continue;
325 *index = device - base;
326 return tty_driver_kref_get(p);
327 }
328 return NULL;
329}
330
331/**
332 * tty_dev_name_to_number - return dev_t for device name
333 * @name: user space name of device under /dev
334 * @number: pointer to dev_t that this function will populate
335 *
336 * This function converts device names like ttyS0 or ttyUSB1 into dev_t
337 * like (4, 64) or (188, 1). If no corresponding driver is registered then
338 * the function returns -ENODEV.
339 *
340 * Locking: this acquires tty_mutex to protect the tty_drivers list from
341 * being modified while we are traversing it, and makes sure to
342 * release it before exiting.
343 */
344int tty_dev_name_to_number(const char *name, dev_t *number)
345{
346 struct tty_driver *p;
347 int ret;
348 int index, prefix_length = 0;
349 const char *str;
350
351 for (str = name; *str && !isdigit(*str); str++)
352 ;
353
354 if (!*str)
355 return -EINVAL;
356
357 ret = kstrtoint(str, 10, &index);
358 if (ret)
359 return ret;
360
361 prefix_length = str - name;
362 mutex_lock(&tty_mutex);
363
364 list_for_each_entry(p, &tty_drivers, tty_drivers)
365 if (prefix_length == strlen(p->name) && strncmp(name,
366 p->name, prefix_length) == 0) {
367 if (index < p->num) {
368 *number = MKDEV(p->major, p->minor_start + index);
369 goto out;
370 }
371 }
372
373 /* if here then driver wasn't found */
374 ret = -ENODEV;
375out:
376 mutex_unlock(&tty_mutex);
377 return ret;
378}
379EXPORT_SYMBOL_GPL(tty_dev_name_to_number);
380
381#ifdef CONFIG_CONSOLE_POLL
382
383/**
384 * tty_find_polling_driver - find device of a polled tty
385 * @name: name string to match
386 * @line: pointer to resulting tty line nr
387 *
388 * This routine returns a tty driver structure, given a name
389 * and the condition that the tty driver is capable of polled
390 * operation.
391 */
392struct tty_driver *tty_find_polling_driver(char *name, int *line)
393{
394 struct tty_driver *p, *res = NULL;
395 int tty_line = 0;
396 int len;
397 char *str, *stp;
398
399 for (str = name; *str; str++)
400 if ((*str >= '0' && *str <= '9') || *str == ',')
401 break;
402 if (!*str)
403 return NULL;
404
405 len = str - name;
406 tty_line = simple_strtoul(str, &str, 10);
407
408 mutex_lock(&tty_mutex);
409 /* Search through the tty devices to look for a match */
410 list_for_each_entry(p, &tty_drivers, tty_drivers) {
411 if (strncmp(name, p->name, len) != 0)
412 continue;
413 stp = str;
414 if (*stp == ',')
415 stp++;
416 if (*stp == '\0')
417 stp = NULL;
418
419 if (tty_line >= 0 && tty_line < p->num && p->ops &&
420 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
421 res = tty_driver_kref_get(p);
422 *line = tty_line;
423 break;
424 }
425 }
426 mutex_unlock(&tty_mutex);
427
428 return res;
429}
430EXPORT_SYMBOL_GPL(tty_find_polling_driver);
431#endif
432
433static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
434 size_t count, loff_t *ppos)
435{
436 return 0;
437}
438
439static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
440 size_t count, loff_t *ppos)
441{
442 return -EIO;
443}
444
445/* No kernel lock held - none needed ;) */
446static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
447{
448 return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
449}
450
451static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
452 unsigned long arg)
453{
454 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
455}
456
457static long hung_up_tty_compat_ioctl(struct file *file,
458 unsigned int cmd, unsigned long arg)
459{
460 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
461}
462
463static int hung_up_tty_fasync(int fd, struct file *file, int on)
464{
465 return -ENOTTY;
466}
467
468static void tty_show_fdinfo(struct seq_file *m, struct file *file)
469{
470 struct tty_struct *tty = file_tty(file);
471
472 if (tty && tty->ops && tty->ops->show_fdinfo)
473 tty->ops->show_fdinfo(tty, m);
474}
475
476static const struct file_operations tty_fops = {
477 .llseek = no_llseek,
478 .read = tty_read,
479 .write = tty_write,
480 .poll = tty_poll,
481 .unlocked_ioctl = tty_ioctl,
482 .compat_ioctl = tty_compat_ioctl,
483 .open = tty_open,
484 .release = tty_release,
485 .fasync = tty_fasync,
486 .show_fdinfo = tty_show_fdinfo,
487};
488
489static const struct file_operations console_fops = {
490 .llseek = no_llseek,
491 .read = tty_read,
492 .write = redirected_tty_write,
493 .poll = tty_poll,
494 .unlocked_ioctl = tty_ioctl,
495 .compat_ioctl = tty_compat_ioctl,
496 .open = tty_open,
497 .release = tty_release,
498 .fasync = tty_fasync,
499};
500
501static const struct file_operations hung_up_tty_fops = {
502 .llseek = no_llseek,
503 .read = hung_up_tty_read,
504 .write = hung_up_tty_write,
505 .poll = hung_up_tty_poll,
506 .unlocked_ioctl = hung_up_tty_ioctl,
507 .compat_ioctl = hung_up_tty_compat_ioctl,
508 .release = tty_release,
509 .fasync = hung_up_tty_fasync,
510};
511
512static DEFINE_SPINLOCK(redirect_lock);
513static struct file *redirect;
514
515/**
516 * tty_wakeup - request more data
517 * @tty: terminal
518 *
519 * Internal and external helper for wakeups of tty. This function
520 * informs the line discipline if present that the driver is ready
521 * to receive more output data.
522 */
523
524void tty_wakeup(struct tty_struct *tty)
525{
526 struct tty_ldisc *ld;
527
528 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
529 ld = tty_ldisc_ref(tty);
530 if (ld) {
531 if (ld->ops->write_wakeup)
532 ld->ops->write_wakeup(tty);
533 tty_ldisc_deref(ld);
534 }
535 }
536 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
537}
538
539EXPORT_SYMBOL_GPL(tty_wakeup);
540
541/**
542 * __tty_hangup - actual handler for hangup events
543 * @work: tty device
544 *
545 * This can be called by a "kworker" kernel thread. That is process
546 * synchronous but doesn't hold any locks, so we need to make sure we
547 * have the appropriate locks for what we're doing.
548 *
549 * The hangup event clears any pending redirections onto the hung up
550 * device. It ensures future writes will error and it does the needed
551 * line discipline hangup and signal delivery. The tty object itself
552 * remains intact.
553 *
554 * Locking:
555 * BTM
556 * redirect lock for undoing redirection
557 * file list lock for manipulating list of ttys
558 * tty_ldiscs_lock from called functions
559 * termios_rwsem resetting termios data
560 * tasklist_lock to walk task list for hangup event
561 * ->siglock to protect ->signal/->sighand
562 */
563static void __tty_hangup(struct tty_struct *tty, int exit_session)
564{
565 struct file *cons_filp = NULL;
566 struct file *filp, *f = NULL;
567 struct tty_file_private *priv;
568 int closecount = 0, n;
569 int refs;
570
571 if (!tty)
572 return;
573
574
575 spin_lock(&redirect_lock);
576 if (redirect && file_tty(redirect) == tty) {
577 f = redirect;
578 redirect = NULL;
579 }
580 spin_unlock(&redirect_lock);
581
582 tty_lock(tty);
583
584 if (test_bit(TTY_HUPPED, &tty->flags)) {
585 tty_unlock(tty);
586 return;
587 }
588
589 /*
590 * Some console devices aren't actually hung up for technical and
591 * historical reasons, which can lead to indefinite interruptible
592 * sleep in n_tty_read(). The following explicitly tells
593 * n_tty_read() to abort readers.
594 */
595 set_bit(TTY_HUPPING, &tty->flags);
596
597 /* inuse_filps is protected by the single tty lock,
598 this really needs to change if we want to flush the
599 workqueue with the lock held */
600 check_tty_count(tty, "tty_hangup");
601
602 spin_lock(&tty->files_lock);
603 /* This breaks for file handles being sent over AF_UNIX sockets ? */
604 list_for_each_entry(priv, &tty->tty_files, list) {
605 filp = priv->file;
606 if (filp->f_op->write == redirected_tty_write)
607 cons_filp = filp;
608 if (filp->f_op->write != tty_write)
609 continue;
610 closecount++;
611 __tty_fasync(-1, filp, 0); /* can't block */
612 filp->f_op = &hung_up_tty_fops;
613 }
614 spin_unlock(&tty->files_lock);
615
616 refs = tty_signal_session_leader(tty, exit_session);
617 /* Account for the p->signal references we killed */
618 while (refs--)
619 tty_kref_put(tty);
620
621 tty_ldisc_hangup(tty, cons_filp != NULL);
622
623 spin_lock_irq(&tty->ctrl_lock);
624 clear_bit(TTY_THROTTLED, &tty->flags);
625 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
626 put_pid(tty->session);
627 put_pid(tty->pgrp);
628 tty->session = NULL;
629 tty->pgrp = NULL;
630 tty->ctrl_status = 0;
631 spin_unlock_irq(&tty->ctrl_lock);
632
633 /*
634 * If one of the devices matches a console pointer, we
635 * cannot just call hangup() because that will cause
636 * tty->count and state->count to go out of sync.
637 * So we just call close() the right number of times.
638 */
639 if (cons_filp) {
640 if (tty->ops->close)
641 for (n = 0; n < closecount; n++)
642 tty->ops->close(tty, cons_filp);
643 } else if (tty->ops->hangup)
644 tty->ops->hangup(tty);
645 /*
646 * We don't want to have driver/ldisc interactions beyond the ones
647 * we did here. The driver layer expects no calls after ->hangup()
648 * from the ldisc side, which is now guaranteed.
649 */
650 set_bit(TTY_HUPPED, &tty->flags);
651 clear_bit(TTY_HUPPING, &tty->flags);
652 tty_unlock(tty);
653
654 if (f)
655 fput(f);
656}
657
658static void do_tty_hangup(struct work_struct *work)
659{
660 struct tty_struct *tty =
661 container_of(work, struct tty_struct, hangup_work);
662
663 __tty_hangup(tty, 0);
664}
665
666/**
667 * tty_hangup - trigger a hangup event
668 * @tty: tty to hangup
669 *
670 * A carrier loss (virtual or otherwise) has occurred on this like
671 * schedule a hangup sequence to run after this event.
672 */
673
674void tty_hangup(struct tty_struct *tty)
675{
676 tty_debug_hangup(tty, "hangup\n");
677 schedule_work(&tty->hangup_work);
678}
679
680EXPORT_SYMBOL(tty_hangup);
681
682/**
683 * tty_vhangup - process vhangup
684 * @tty: tty to hangup
685 *
686 * The user has asked via system call for the terminal to be hung up.
687 * We do this synchronously so that when the syscall returns the process
688 * is complete. That guarantee is necessary for security reasons.
689 */
690
691void tty_vhangup(struct tty_struct *tty)
692{
693 tty_debug_hangup(tty, "vhangup\n");
694 __tty_hangup(tty, 0);
695}
696
697EXPORT_SYMBOL(tty_vhangup);
698
699
700/**
701 * tty_vhangup_self - process vhangup for own ctty
702 *
703 * Perform a vhangup on the current controlling tty
704 */
705
706void tty_vhangup_self(void)
707{
708 struct tty_struct *tty;
709
710 tty = get_current_tty();
711 if (tty) {
712 tty_vhangup(tty);
713 tty_kref_put(tty);
714 }
715}
716
717/**
718 * tty_vhangup_session - hangup session leader exit
719 * @tty: tty to hangup
720 *
721 * The session leader is exiting and hanging up its controlling terminal.
722 * Every process in the foreground process group is signalled SIGHUP.
723 *
724 * We do this synchronously so that when the syscall returns the process
725 * is complete. That guarantee is necessary for security reasons.
726 */
727
728void tty_vhangup_session(struct tty_struct *tty)
729{
730 tty_debug_hangup(tty, "session hangup\n");
731 __tty_hangup(tty, 1);
732}
733
734/**
735 * tty_hung_up_p - was tty hung up
736 * @filp: file pointer of tty
737 *
738 * Return true if the tty has been subject to a vhangup or a carrier
739 * loss
740 */
741
742int tty_hung_up_p(struct file *filp)
743{
744 return (filp && filp->f_op == &hung_up_tty_fops);
745}
746
747EXPORT_SYMBOL(tty_hung_up_p);
748
749/**
750 * stop_tty - propagate flow control
751 * @tty: tty to stop
752 *
753 * Perform flow control to the driver. May be called
754 * on an already stopped device and will not re-call the driver
755 * method.
756 *
757 * This functionality is used by both the line disciplines for
758 * halting incoming flow and by the driver. It may therefore be
759 * called from any context, may be under the tty atomic_write_lock
760 * but not always.
761 *
762 * Locking:
763 * flow_lock
764 */
765
766void __stop_tty(struct tty_struct *tty)
767{
768 if (tty->stopped)
769 return;
770 tty->stopped = 1;
771 if (tty->ops->stop)
772 tty->ops->stop(tty);
773}
774
775void stop_tty(struct tty_struct *tty)
776{
777 unsigned long flags;
778
779 spin_lock_irqsave(&tty->flow_lock, flags);
780 __stop_tty(tty);
781 spin_unlock_irqrestore(&tty->flow_lock, flags);
782}
783EXPORT_SYMBOL(stop_tty);
784
785/**
786 * start_tty - propagate flow control
787 * @tty: tty to start
788 *
789 * Start a tty that has been stopped if at all possible. If this
790 * tty was previous stopped and is now being started, the driver
791 * start method is invoked and the line discipline woken.
792 *
793 * Locking:
794 * flow_lock
795 */
796
797void __start_tty(struct tty_struct *tty)
798{
799 if (!tty->stopped || tty->flow_stopped)
800 return;
801 tty->stopped = 0;
802 if (tty->ops->start)
803 tty->ops->start(tty);
804 tty_wakeup(tty);
805}
806
807void start_tty(struct tty_struct *tty)
808{
809 unsigned long flags;
810
811 spin_lock_irqsave(&tty->flow_lock, flags);
812 __start_tty(tty);
813 spin_unlock_irqrestore(&tty->flow_lock, flags);
814}
815EXPORT_SYMBOL(start_tty);
816
817static void tty_update_time(struct timespec *time)
818{
819 unsigned long sec = get_seconds();
820
821 /*
822 * We only care if the two values differ in anything other than the
823 * lower three bits (i.e every 8 seconds). If so, then we can update
824 * the time of the tty device, otherwise it could be construded as a
825 * security leak to let userspace know the exact timing of the tty.
826 */
827 if ((sec ^ time->tv_sec) & ~7)
828 time->tv_sec = sec;
829}
830
831/**
832 * tty_read - read method for tty device files
833 * @file: pointer to tty file
834 * @buf: user buffer
835 * @count: size of user buffer
836 * @ppos: unused
837 *
838 * Perform the read system call function on this terminal device. Checks
839 * for hung up devices before calling the line discipline method.
840 *
841 * Locking:
842 * Locks the line discipline internally while needed. Multiple
843 * read calls may be outstanding in parallel.
844 */
845
846static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
847 loff_t *ppos)
848{
849 int i;
850 struct inode *inode = file_inode(file);
851 struct tty_struct *tty = file_tty(file);
852 struct tty_ldisc *ld;
853
854 if (tty_paranoia_check(tty, inode, "tty_read"))
855 return -EIO;
856 if (!tty || tty_io_error(tty))
857 return -EIO;
858
859 /* We want to wait for the line discipline to sort out in this
860 situation */
861 ld = tty_ldisc_ref_wait(tty);
862 if (!ld)
863 return hung_up_tty_read(file, buf, count, ppos);
864 if (ld->ops->read)
865 i = ld->ops->read(tty, file, buf, count);
866 else
867 i = -EIO;
868 tty_ldisc_deref(ld);
869
870 if (i > 0)
871 tty_update_time(&inode->i_atime);
872
873 return i;
874}
875
876static void tty_write_unlock(struct tty_struct *tty)
877{
878 mutex_unlock(&tty->atomic_write_lock);
879 wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
880}
881
882static int tty_write_lock(struct tty_struct *tty, int ndelay)
883{
884 if (!mutex_trylock(&tty->atomic_write_lock)) {
885 if (ndelay)
886 return -EAGAIN;
887 if (mutex_lock_interruptible(&tty->atomic_write_lock))
888 return -ERESTARTSYS;
889 }
890 return 0;
891}
892
893/*
894 * Split writes up in sane blocksizes to avoid
895 * denial-of-service type attacks
896 */
897static inline ssize_t do_tty_write(
898 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
899 struct tty_struct *tty,
900 struct file *file,
901 const char __user *buf,
902 size_t count)
903{
904 ssize_t ret, written = 0;
905 unsigned int chunk;
906
907 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
908 if (ret < 0)
909 return ret;
910
911 /*
912 * We chunk up writes into a temporary buffer. This
913 * simplifies low-level drivers immensely, since they
914 * don't have locking issues and user mode accesses.
915 *
916 * But if TTY_NO_WRITE_SPLIT is set, we should use a
917 * big chunk-size..
918 *
919 * The default chunk-size is 2kB, because the NTTY
920 * layer has problems with bigger chunks. It will
921 * claim to be able to handle more characters than
922 * it actually does.
923 *
924 * FIXME: This can probably go away now except that 64K chunks
925 * are too likely to fail unless switched to vmalloc...
926 */
927 chunk = 2048;
928 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
929 chunk = 65536;
930 if (count < chunk)
931 chunk = count;
932
933 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
934 if (tty->write_cnt < chunk) {
935 unsigned char *buf_chunk;
936
937 if (chunk < 1024)
938 chunk = 1024;
939
940 buf_chunk = kmalloc(chunk, GFP_KERNEL);
941 if (!buf_chunk) {
942 ret = -ENOMEM;
943 goto out;
944 }
945 kfree(tty->write_buf);
946 tty->write_cnt = chunk;
947 tty->write_buf = buf_chunk;
948 }
949
950 /* Do the write .. */
951 for (;;) {
952 size_t size = count;
953 if (size > chunk)
954 size = chunk;
955 ret = -EFAULT;
956 if (copy_from_user(tty->write_buf, buf, size))
957 break;
958 ret = write(tty, file, tty->write_buf, size);
959 if (ret <= 0)
960 break;
961 written += ret;
962 buf += ret;
963 count -= ret;
964 if (!count)
965 break;
966 ret = -ERESTARTSYS;
967 if (signal_pending(current))
968 break;
969 cond_resched();
970 }
971 if (written) {
972 tty_update_time(&file_inode(file)->i_mtime);
973 ret = written;
974 }
975out:
976 tty_write_unlock(tty);
977 return ret;
978}
979
980/**
981 * tty_write_message - write a message to a certain tty, not just the console.
982 * @tty: the destination tty_struct
983 * @msg: the message to write
984 *
985 * This is used for messages that need to be redirected to a specific tty.
986 * We don't put it into the syslog queue right now maybe in the future if
987 * really needed.
988 *
989 * We must still hold the BTM and test the CLOSING flag for the moment.
990 */
991
992void tty_write_message(struct tty_struct *tty, char *msg)
993{
994 if (tty) {
995 mutex_lock(&tty->atomic_write_lock);
996 tty_lock(tty);
997 if (tty->ops->write && tty->count > 0)
998 tty->ops->write(tty, msg, strlen(msg));
999 tty_unlock(tty);
1000 tty_write_unlock(tty);
1001 }
1002 return;
1003}
1004
1005
1006/**
1007 * tty_write - write method for tty device file
1008 * @file: tty file pointer
1009 * @buf: user data to write
1010 * @count: bytes to write
1011 * @ppos: unused
1012 *
1013 * Write data to a tty device via the line discipline.
1014 *
1015 * Locking:
1016 * Locks the line discipline as required
1017 * Writes to the tty driver are serialized by the atomic_write_lock
1018 * and are then processed in chunks to the device. The line discipline
1019 * write method will not be invoked in parallel for each device.
1020 */
1021
1022static ssize_t tty_write(struct file *file, const char __user *buf,
1023 size_t count, loff_t *ppos)
1024{
1025 struct tty_struct *tty = file_tty(file);
1026 struct tty_ldisc *ld;
1027 ssize_t ret;
1028
1029 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1030 return -EIO;
1031 if (!tty || !tty->ops->write || tty_io_error(tty))
1032 return -EIO;
1033 /* Short term debug to catch buggy drivers */
1034 if (tty->ops->write_room == NULL)
1035 tty_err(tty, "missing write_room method\n");
1036 ld = tty_ldisc_ref_wait(tty);
1037 if (!ld)
1038 return hung_up_tty_write(file, buf, count, ppos);
1039 if (!ld->ops->write)
1040 ret = -EIO;
1041 else
1042 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1043 tty_ldisc_deref(ld);
1044 return ret;
1045}
1046
1047ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1048 size_t count, loff_t *ppos)
1049{
1050 struct file *p = NULL;
1051
1052 spin_lock(&redirect_lock);
1053 if (redirect)
1054 p = get_file(redirect);
1055 spin_unlock(&redirect_lock);
1056
1057 if (p) {
1058 ssize_t res;
1059 res = vfs_write(p, buf, count, &p->f_pos);
1060 fput(p);
1061 return res;
1062 }
1063 return tty_write(file, buf, count, ppos);
1064}
1065
1066/**
1067 * tty_send_xchar - send priority character
1068 *
1069 * Send a high priority character to the tty even if stopped
1070 *
1071 * Locking: none for xchar method, write ordering for write method.
1072 */
1073
1074int tty_send_xchar(struct tty_struct *tty, char ch)
1075{
1076 int was_stopped = tty->stopped;
1077
1078 if (tty->ops->send_xchar) {
1079 down_read(&tty->termios_rwsem);
1080 tty->ops->send_xchar(tty, ch);
1081 up_read(&tty->termios_rwsem);
1082 return 0;
1083 }
1084
1085 if (tty_write_lock(tty, 0) < 0)
1086 return -ERESTARTSYS;
1087
1088 down_read(&tty->termios_rwsem);
1089 if (was_stopped)
1090 start_tty(tty);
1091 tty->ops->write(tty, &ch, 1);
1092 if (was_stopped)
1093 stop_tty(tty);
1094 up_read(&tty->termios_rwsem);
1095 tty_write_unlock(tty);
1096 return 0;
1097}
1098
1099static char ptychar[] = "pqrstuvwxyzabcde";
1100
1101/**
1102 * pty_line_name - generate name for a pty
1103 * @driver: the tty driver in use
1104 * @index: the minor number
1105 * @p: output buffer of at least 6 bytes
1106 *
1107 * Generate a name from a driver reference and write it to the output
1108 * buffer.
1109 *
1110 * Locking: None
1111 */
1112static void pty_line_name(struct tty_driver *driver, int index, char *p)
1113{
1114 int i = index + driver->name_base;
1115 /* ->name is initialized to "ttyp", but "tty" is expected */
1116 sprintf(p, "%s%c%x",
1117 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1118 ptychar[i >> 4 & 0xf], i & 0xf);
1119}
1120
1121/**
1122 * tty_line_name - generate name for a tty
1123 * @driver: the tty driver in use
1124 * @index: the minor number
1125 * @p: output buffer of at least 7 bytes
1126 *
1127 * Generate a name from a driver reference and write it to the output
1128 * buffer.
1129 *
1130 * Locking: None
1131 */
1132static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1133{
1134 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1135 return sprintf(p, "%s", driver->name);
1136 else
1137 return sprintf(p, "%s%d", driver->name,
1138 index + driver->name_base);
1139}
1140
1141/**
1142 * tty_driver_lookup_tty() - find an existing tty, if any
1143 * @driver: the driver for the tty
1144 * @idx: the minor number
1145 *
1146 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1147 * driver lookup() method returns an error.
1148 *
1149 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1150 */
1151static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1152 struct file *file, int idx)
1153{
1154 struct tty_struct *tty;
1155
1156 if (driver->ops->lookup)
1157 if (!file)
1158 tty = ERR_PTR(-EIO);
1159 else
1160 tty = driver->ops->lookup(driver, file, idx);
1161 else
1162 tty = driver->ttys[idx];
1163
1164 if (!IS_ERR(tty))
1165 tty_kref_get(tty);
1166 return tty;
1167}
1168
1169/**
1170 * tty_init_termios - helper for termios setup
1171 * @tty: the tty to set up
1172 *
1173 * Initialise the termios structures for this tty. Thus runs under
1174 * the tty_mutex currently so we can be relaxed about ordering.
1175 */
1176
1177void tty_init_termios(struct tty_struct *tty)
1178{
1179 struct ktermios *tp;
1180 int idx = tty->index;
1181
1182 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1183 tty->termios = tty->driver->init_termios;
1184 else {
1185 /* Check for lazy saved data */
1186 tp = tty->driver->termios[idx];
1187 if (tp != NULL) {
1188 tty->termios = *tp;
1189 tty->termios.c_line = tty->driver->init_termios.c_line;
1190 } else
1191 tty->termios = tty->driver->init_termios;
1192 }
1193 /* Compatibility until drivers always set this */
1194 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1195 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1196}
1197EXPORT_SYMBOL_GPL(tty_init_termios);
1198
1199int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1200{
1201 tty_init_termios(tty);
1202 tty_driver_kref_get(driver);
1203 tty->count++;
1204 driver->ttys[tty->index] = tty;
1205 return 0;
1206}
1207EXPORT_SYMBOL_GPL(tty_standard_install);
1208
1209/**
1210 * tty_driver_install_tty() - install a tty entry in the driver
1211 * @driver: the driver for the tty
1212 * @tty: the tty
1213 *
1214 * Install a tty object into the driver tables. The tty->index field
1215 * will be set by the time this is called. This method is responsible
1216 * for ensuring any need additional structures are allocated and
1217 * configured.
1218 *
1219 * Locking: tty_mutex for now
1220 */
1221static int tty_driver_install_tty(struct tty_driver *driver,
1222 struct tty_struct *tty)
1223{
1224 return driver->ops->install ? driver->ops->install(driver, tty) :
1225 tty_standard_install(driver, tty);
1226}
1227
1228/**
1229 * tty_driver_remove_tty() - remove a tty from the driver tables
1230 * @driver: the driver for the tty
1231 * @idx: the minor number
1232 *
1233 * Remvoe a tty object from the driver tables. The tty->index field
1234 * will be set by the time this is called.
1235 *
1236 * Locking: tty_mutex for now
1237 */
1238static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1239{
1240 if (driver->ops->remove)
1241 driver->ops->remove(driver, tty);
1242 else
1243 driver->ttys[tty->index] = NULL;
1244}
1245
1246/*
1247 * tty_reopen() - fast re-open of an open tty
1248 * @tty - the tty to open
1249 *
1250 * Return 0 on success, -errno on error.
1251 * Re-opens on master ptys are not allowed and return -EIO.
1252 *
1253 * Locking: Caller must hold tty_lock
1254 */
1255static int tty_reopen(struct tty_struct *tty)
1256{
1257 struct tty_driver *driver = tty->driver;
1258
1259 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1260 driver->subtype == PTY_TYPE_MASTER)
1261 return -EIO;
1262
1263 if (!tty->count)
1264 return -EAGAIN;
1265
1266 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1267 return -EBUSY;
1268
1269 tty->count++;
1270
1271 if (!tty->ldisc)
1272 return tty_ldisc_reinit(tty, tty->termios.c_line);
1273
1274 return 0;
1275}
1276
1277/**
1278 * tty_init_dev - initialise a tty device
1279 * @driver: tty driver we are opening a device on
1280 * @idx: device index
1281 * @ret_tty: returned tty structure
1282 *
1283 * Prepare a tty device. This may not be a "new" clean device but
1284 * could also be an active device. The pty drivers require special
1285 * handling because of this.
1286 *
1287 * Locking:
1288 * The function is called under the tty_mutex, which
1289 * protects us from the tty struct or driver itself going away.
1290 *
1291 * On exit the tty device has the line discipline attached and
1292 * a reference count of 1. If a pair was created for pty/tty use
1293 * and the other was a pty master then it too has a reference count of 1.
1294 *
1295 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1296 * failed open. The new code protects the open with a mutex, so it's
1297 * really quite straightforward. The mutex locking can probably be
1298 * relaxed for the (most common) case of reopening a tty.
1299 */
1300
1301struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1302{
1303 struct tty_struct *tty;
1304 int retval;
1305
1306 /*
1307 * First time open is complex, especially for PTY devices.
1308 * This code guarantees that either everything succeeds and the
1309 * TTY is ready for operation, or else the table slots are vacated
1310 * and the allocated memory released. (Except that the termios
1311 * may be retained.)
1312 */
1313
1314 if (!try_module_get(driver->owner))
1315 return ERR_PTR(-ENODEV);
1316
1317 tty = alloc_tty_struct(driver, idx);
1318 if (!tty) {
1319 retval = -ENOMEM;
1320 goto err_module_put;
1321 }
1322
1323 tty_lock(tty);
1324 retval = tty_driver_install_tty(driver, tty);
1325 if (retval < 0)
1326 goto err_free_tty;
1327
1328 if (!tty->port)
1329 tty->port = driver->ports[idx];
1330
1331 WARN_RATELIMIT(!tty->port,
1332 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1333 __func__, tty->driver->name);
1334
1335 retval = tty_ldisc_lock(tty, 5 * HZ);
1336 if (retval)
1337 goto err_release_lock;
1338 tty->port->itty = tty;
1339
1340 /*
1341 * Structures all installed ... call the ldisc open routines.
1342 * If we fail here just call release_tty to clean up. No need
1343 * to decrement the use counts, as release_tty doesn't care.
1344 */
1345 retval = tty_ldisc_setup(tty, tty->link);
1346 if (retval)
1347 goto err_release_tty;
1348 tty_ldisc_unlock(tty);
1349 /* Return the tty locked so that it cannot vanish under the caller */
1350 return tty;
1351
1352err_free_tty:
1353 tty_unlock(tty);
1354 free_tty_struct(tty);
1355err_module_put:
1356 module_put(driver->owner);
1357 return ERR_PTR(retval);
1358
1359 /* call the tty release_tty routine to clean out this slot */
1360err_release_tty:
1361 tty_ldisc_unlock(tty);
1362 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1363 retval, idx);
1364err_release_lock:
1365 tty_unlock(tty);
1366 release_tty(tty, idx);
1367 return ERR_PTR(retval);
1368}
1369
1370static void tty_free_termios(struct tty_struct *tty)
1371{
1372 struct ktermios *tp;
1373 int idx = tty->index;
1374
1375 /* If the port is going to reset then it has no termios to save */
1376 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1377 return;
1378
1379 /* Stash the termios data */
1380 tp = tty->driver->termios[idx];
1381 if (tp == NULL) {
1382 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1383 if (tp == NULL)
1384 return;
1385 tty->driver->termios[idx] = tp;
1386 }
1387 *tp = tty->termios;
1388}
1389
1390/**
1391 * tty_flush_works - flush all works of a tty/pty pair
1392 * @tty: tty device to flush works for (or either end of a pty pair)
1393 *
1394 * Sync flush all works belonging to @tty (and the 'other' tty).
1395 */
1396static void tty_flush_works(struct tty_struct *tty)
1397{
1398 flush_work(&tty->SAK_work);
1399 flush_work(&tty->hangup_work);
1400 if (tty->link) {
1401 flush_work(&tty->link->SAK_work);
1402 flush_work(&tty->link->hangup_work);
1403 }
1404}
1405
1406/**
1407 * release_one_tty - release tty structure memory
1408 * @kref: kref of tty we are obliterating
1409 *
1410 * Releases memory associated with a tty structure, and clears out the
1411 * driver table slots. This function is called when a device is no longer
1412 * in use. It also gets called when setup of a device fails.
1413 *
1414 * Locking:
1415 * takes the file list lock internally when working on the list
1416 * of ttys that the driver keeps.
1417 *
1418 * This method gets called from a work queue so that the driver private
1419 * cleanup ops can sleep (needed for USB at least)
1420 */
1421static void release_one_tty(struct work_struct *work)
1422{
1423 struct tty_struct *tty =
1424 container_of(work, struct tty_struct, hangup_work);
1425 struct tty_driver *driver = tty->driver;
1426 struct module *owner = driver->owner;
1427
1428 if (tty->ops->cleanup)
1429 tty->ops->cleanup(tty);
1430
1431 tty->magic = 0;
1432 tty_driver_kref_put(driver);
1433 module_put(owner);
1434
1435 spin_lock(&tty->files_lock);
1436 list_del_init(&tty->tty_files);
1437 spin_unlock(&tty->files_lock);
1438
1439 put_pid(tty->pgrp);
1440 put_pid(tty->session);
1441 free_tty_struct(tty);
1442}
1443
1444static void queue_release_one_tty(struct kref *kref)
1445{
1446 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1447
1448 /* The hangup queue is now free so we can reuse it rather than
1449 waste a chunk of memory for each port */
1450 INIT_WORK(&tty->hangup_work, release_one_tty);
1451 schedule_work(&tty->hangup_work);
1452}
1453
1454/**
1455 * tty_kref_put - release a tty kref
1456 * @tty: tty device
1457 *
1458 * Release a reference to a tty device and if need be let the kref
1459 * layer destruct the object for us
1460 */
1461
1462void tty_kref_put(struct tty_struct *tty)
1463{
1464 if (tty)
1465 kref_put(&tty->kref, queue_release_one_tty);
1466}
1467EXPORT_SYMBOL(tty_kref_put);
1468
1469/**
1470 * release_tty - release tty structure memory
1471 *
1472 * Release both @tty and a possible linked partner (think pty pair),
1473 * and decrement the refcount of the backing module.
1474 *
1475 * Locking:
1476 * tty_mutex
1477 * takes the file list lock internally when working on the list
1478 * of ttys that the driver keeps.
1479 *
1480 */
1481static void release_tty(struct tty_struct *tty, int idx)
1482{
1483 /* This should always be true but check for the moment */
1484 WARN_ON(tty->index != idx);
1485 WARN_ON(!mutex_is_locked(&tty_mutex));
1486 if (tty->ops->shutdown)
1487 tty->ops->shutdown(tty);
1488 tty_free_termios(tty);
1489 tty_driver_remove_tty(tty->driver, tty);
1490 tty->port->itty = NULL;
1491 if (tty->link)
1492 tty->link->port->itty = NULL;
1493 tty_buffer_cancel_work(tty->port);
1494 if (tty->link)
1495 tty_buffer_cancel_work(tty->link->port);
1496
1497 tty_kref_put(tty->link);
1498 tty_kref_put(tty);
1499}
1500
1501/**
1502 * tty_release_checks - check a tty before real release
1503 * @tty: tty to check
1504 * @o_tty: link of @tty (if any)
1505 * @idx: index of the tty
1506 *
1507 * Performs some paranoid checking before true release of the @tty.
1508 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1509 */
1510static int tty_release_checks(struct tty_struct *tty, int idx)
1511{
1512#ifdef TTY_PARANOIA_CHECK
1513 if (idx < 0 || idx >= tty->driver->num) {
1514 tty_debug(tty, "bad idx %d\n", idx);
1515 return -1;
1516 }
1517
1518 /* not much to check for devpts */
1519 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1520 return 0;
1521
1522 if (tty != tty->driver->ttys[idx]) {
1523 tty_debug(tty, "bad driver table[%d] = %p\n",
1524 idx, tty->driver->ttys[idx]);
1525 return -1;
1526 }
1527 if (tty->driver->other) {
1528 struct tty_struct *o_tty = tty->link;
1529
1530 if (o_tty != tty->driver->other->ttys[idx]) {
1531 tty_debug(tty, "bad other table[%d] = %p\n",
1532 idx, tty->driver->other->ttys[idx]);
1533 return -1;
1534 }
1535 if (o_tty->link != tty) {
1536 tty_debug(tty, "bad link = %p\n", o_tty->link);
1537 return -1;
1538 }
1539 }
1540#endif
1541 return 0;
1542}
1543
1544/**
1545 * tty_kclose - closes tty opened by tty_kopen
1546 * @tty: tty device
1547 *
1548 * Performs the final steps to release and free a tty device. It is the
1549 * same as tty_release_struct except that it also resets TTY_PORT_KOPENED
1550 * flag on tty->port.
1551 */
1552void tty_kclose(struct tty_struct *tty)
1553{
1554 /*
1555 * Ask the line discipline code to release its structures
1556 */
1557 tty_ldisc_release(tty);
1558
1559 /* Wait for pending work before tty destruction commmences */
1560 tty_flush_works(tty);
1561
1562 tty_debug_hangup(tty, "freeing structure\n");
1563 /*
1564 * The release_tty function takes care of the details of clearing
1565 * the slots and preserving the termios structure. The tty_unlock_pair
1566 * should be safe as we keep a kref while the tty is locked (so the
1567 * unlock never unlocks a freed tty).
1568 */
1569 mutex_lock(&tty_mutex);
1570 tty_port_set_kopened(tty->port, 0);
1571 release_tty(tty, tty->index);
1572 mutex_unlock(&tty_mutex);
1573}
1574EXPORT_SYMBOL_GPL(tty_kclose);
1575
1576/**
1577 * tty_release_struct - release a tty struct
1578 * @tty: tty device
1579 * @idx: index of the tty
1580 *
1581 * Performs the final steps to release and free a tty device. It is
1582 * roughly the reverse of tty_init_dev.
1583 */
1584void tty_release_struct(struct tty_struct *tty, int idx)
1585{
1586 /*
1587 * Ask the line discipline code to release its structures
1588 */
1589 tty_ldisc_release(tty);
1590
1591 /* Wait for pending work before tty destruction commmences */
1592 tty_flush_works(tty);
1593
1594 tty_debug_hangup(tty, "freeing structure\n");
1595 /*
1596 * The release_tty function takes care of the details of clearing
1597 * the slots and preserving the termios structure. The tty_unlock_pair
1598 * should be safe as we keep a kref while the tty is locked (so the
1599 * unlock never unlocks a freed tty).
1600 */
1601 mutex_lock(&tty_mutex);
1602 release_tty(tty, idx);
1603 mutex_unlock(&tty_mutex);
1604}
1605EXPORT_SYMBOL_GPL(tty_release_struct);
1606
1607/**
1608 * tty_release - vfs callback for close
1609 * @inode: inode of tty
1610 * @filp: file pointer for handle to tty
1611 *
1612 * Called the last time each file handle is closed that references
1613 * this tty. There may however be several such references.
1614 *
1615 * Locking:
1616 * Takes bkl. See tty_release_dev
1617 *
1618 * Even releasing the tty structures is a tricky business.. We have
1619 * to be very careful that the structures are all released at the
1620 * same time, as interrupts might otherwise get the wrong pointers.
1621 *
1622 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1623 * lead to double frees or releasing memory still in use.
1624 */
1625
1626int tty_release(struct inode *inode, struct file *filp)
1627{
1628 struct tty_struct *tty = file_tty(filp);
1629 struct tty_struct *o_tty = NULL;
1630 int do_sleep, final;
1631 int idx;
1632 long timeout = 0;
1633 int once = 1;
1634
1635 if (tty_paranoia_check(tty, inode, __func__))
1636 return 0;
1637
1638 tty_lock(tty);
1639 check_tty_count(tty, __func__);
1640
1641 __tty_fasync(-1, filp, 0);
1642
1643 idx = tty->index;
1644 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1645 tty->driver->subtype == PTY_TYPE_MASTER)
1646 o_tty = tty->link;
1647
1648 if (tty_release_checks(tty, idx)) {
1649 tty_unlock(tty);
1650 return 0;
1651 }
1652
1653 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1654
1655 if (tty->ops->close)
1656 tty->ops->close(tty, filp);
1657
1658 /* If tty is pty master, lock the slave pty (stable lock order) */
1659 tty_lock_slave(o_tty);
1660
1661 /*
1662 * Sanity check: if tty->count is going to zero, there shouldn't be
1663 * any waiters on tty->read_wait or tty->write_wait. We test the
1664 * wait queues and kick everyone out _before_ actually starting to
1665 * close. This ensures that we won't block while releasing the tty
1666 * structure.
1667 *
1668 * The test for the o_tty closing is necessary, since the master and
1669 * slave sides may close in any order. If the slave side closes out
1670 * first, its count will be one, since the master side holds an open.
1671 * Thus this test wouldn't be triggered at the time the slave closed,
1672 * so we do it now.
1673 */
1674 while (1) {
1675 do_sleep = 0;
1676
1677 if (tty->count <= 1) {
1678 if (waitqueue_active(&tty->read_wait)) {
1679 wake_up_poll(&tty->read_wait, EPOLLIN);
1680 do_sleep++;
1681 }
1682 if (waitqueue_active(&tty->write_wait)) {
1683 wake_up_poll(&tty->write_wait, EPOLLOUT);
1684 do_sleep++;
1685 }
1686 }
1687 if (o_tty && o_tty->count <= 1) {
1688 if (waitqueue_active(&o_tty->read_wait)) {
1689 wake_up_poll(&o_tty->read_wait, EPOLLIN);
1690 do_sleep++;
1691 }
1692 if (waitqueue_active(&o_tty->write_wait)) {
1693 wake_up_poll(&o_tty->write_wait, EPOLLOUT);
1694 do_sleep++;
1695 }
1696 }
1697 if (!do_sleep)
1698 break;
1699
1700 if (once) {
1701 once = 0;
1702 tty_warn(tty, "read/write wait queue active!\n");
1703 }
1704 schedule_timeout_killable(timeout);
1705 if (timeout < 120 * HZ)
1706 timeout = 2 * timeout + 1;
1707 else
1708 timeout = MAX_SCHEDULE_TIMEOUT;
1709 }
1710
1711 if (o_tty) {
1712 if (--o_tty->count < 0) {
1713 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1714 o_tty->count = 0;
1715 }
1716 }
1717 if (--tty->count < 0) {
1718 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1719 tty->count = 0;
1720 }
1721
1722 /*
1723 * We've decremented tty->count, so we need to remove this file
1724 * descriptor off the tty->tty_files list; this serves two
1725 * purposes:
1726 * - check_tty_count sees the correct number of file descriptors
1727 * associated with this tty.
1728 * - do_tty_hangup no longer sees this file descriptor as
1729 * something that needs to be handled for hangups.
1730 */
1731 tty_del_file(filp);
1732
1733 /*
1734 * Perform some housekeeping before deciding whether to return.
1735 *
1736 * If _either_ side is closing, make sure there aren't any
1737 * processes that still think tty or o_tty is their controlling
1738 * tty.
1739 */
1740 if (!tty->count) {
1741 read_lock(&tasklist_lock);
1742 session_clear_tty(tty->session);
1743 if (o_tty)
1744 session_clear_tty(o_tty->session);
1745 read_unlock(&tasklist_lock);
1746 }
1747
1748 /* check whether both sides are closing ... */
1749 final = !tty->count && !(o_tty && o_tty->count);
1750
1751 tty_unlock_slave(o_tty);
1752 tty_unlock(tty);
1753
1754 /* At this point, the tty->count == 0 should ensure a dead tty
1755 cannot be re-opened by a racing opener */
1756
1757 if (!final)
1758 return 0;
1759
1760 tty_debug_hangup(tty, "final close\n");
1761
1762 tty_release_struct(tty, idx);
1763 return 0;
1764}
1765
1766/**
1767 * tty_open_current_tty - get locked tty of current task
1768 * @device: device number
1769 * @filp: file pointer to tty
1770 * @return: locked tty of the current task iff @device is /dev/tty
1771 *
1772 * Performs a re-open of the current task's controlling tty.
1773 *
1774 * We cannot return driver and index like for the other nodes because
1775 * devpts will not work then. It expects inodes to be from devpts FS.
1776 */
1777static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1778{
1779 struct tty_struct *tty;
1780 int retval;
1781
1782 if (device != MKDEV(TTYAUX_MAJOR, 0))
1783 return NULL;
1784
1785 tty = get_current_tty();
1786 if (!tty)
1787 return ERR_PTR(-ENXIO);
1788
1789 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1790 /* noctty = 1; */
1791 tty_lock(tty);
1792 tty_kref_put(tty); /* safe to drop the kref now */
1793
1794 retval = tty_reopen(tty);
1795 if (retval < 0) {
1796 tty_unlock(tty);
1797 tty = ERR_PTR(retval);
1798 }
1799 return tty;
1800}
1801
1802/**
1803 * tty_lookup_driver - lookup a tty driver for a given device file
1804 * @device: device number
1805 * @filp: file pointer to tty
1806 * @index: index for the device in the @return driver
1807 * @return: driver for this inode (with increased refcount)
1808 *
1809 * If @return is not erroneous, the caller is responsible to decrement the
1810 * refcount by tty_driver_kref_put.
1811 *
1812 * Locking: tty_mutex protects get_tty_driver
1813 */
1814static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1815 int *index)
1816{
1817 struct tty_driver *driver;
1818
1819 switch (device) {
1820#ifdef CONFIG_VT
1821 case MKDEV(TTY_MAJOR, 0): {
1822 extern struct tty_driver *console_driver;
1823 driver = tty_driver_kref_get(console_driver);
1824 *index = fg_console;
1825 break;
1826 }
1827#endif
1828 case MKDEV(TTYAUX_MAJOR, 1): {
1829 struct tty_driver *console_driver = console_device(index);
1830 if (console_driver) {
1831 driver = tty_driver_kref_get(console_driver);
1832 if (driver && filp) {
1833 /* Don't let /dev/console block */
1834 filp->f_flags |= O_NONBLOCK;
1835 break;
1836 }
1837 }
1838 return ERR_PTR(-ENODEV);
1839 }
1840 default:
1841 driver = get_tty_driver(device, index);
1842 if (!driver)
1843 return ERR_PTR(-ENODEV);
1844 break;
1845 }
1846 return driver;
1847}
1848
1849/**
1850 * tty_kopen - open a tty device for kernel
1851 * @device: dev_t of device to open
1852 *
1853 * Opens tty exclusively for kernel. Performs the driver lookup,
1854 * makes sure it's not already opened and performs the first-time
1855 * tty initialization.
1856 *
1857 * Returns the locked initialized &tty_struct
1858 *
1859 * Claims the global tty_mutex to serialize:
1860 * - concurrent first-time tty initialization
1861 * - concurrent tty driver removal w/ lookup
1862 * - concurrent tty removal from driver table
1863 */
1864struct tty_struct *tty_kopen(dev_t device)
1865{
1866 struct tty_struct *tty;
1867 struct tty_driver *driver = NULL;
1868 int index = -1;
1869
1870 mutex_lock(&tty_mutex);
1871 driver = tty_lookup_driver(device, NULL, &index);
1872 if (IS_ERR(driver)) {
1873 mutex_unlock(&tty_mutex);
1874 return ERR_CAST(driver);
1875 }
1876
1877 /* check whether we're reopening an existing tty */
1878 tty = tty_driver_lookup_tty(driver, NULL, index);
1879 if (IS_ERR(tty))
1880 goto out;
1881
1882 if (tty) {
1883 /* drop kref from tty_driver_lookup_tty() */
1884 tty_kref_put(tty);
1885 tty = ERR_PTR(-EBUSY);
1886 } else { /* tty_init_dev returns tty with the tty_lock held */
1887 tty = tty_init_dev(driver, index);
1888 if (IS_ERR(tty))
1889 goto out;
1890 tty_port_set_kopened(tty->port, 1);
1891 }
1892out:
1893 mutex_unlock(&tty_mutex);
1894 tty_driver_kref_put(driver);
1895 return tty;
1896}
1897EXPORT_SYMBOL_GPL(tty_kopen);
1898
1899/**
1900 * tty_open_by_driver - open a tty device
1901 * @device: dev_t of device to open
1902 * @inode: inode of device file
1903 * @filp: file pointer to tty
1904 *
1905 * Performs the driver lookup, checks for a reopen, or otherwise
1906 * performs the first-time tty initialization.
1907 *
1908 * Returns the locked initialized or re-opened &tty_struct
1909 *
1910 * Claims the global tty_mutex to serialize:
1911 * - concurrent first-time tty initialization
1912 * - concurrent tty driver removal w/ lookup
1913 * - concurrent tty removal from driver table
1914 */
1915static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
1916 struct file *filp)
1917{
1918 struct tty_struct *tty;
1919 struct tty_driver *driver = NULL;
1920 int index = -1;
1921 int retval;
1922
1923 mutex_lock(&tty_mutex);
1924 driver = tty_lookup_driver(device, filp, &index);
1925 if (IS_ERR(driver)) {
1926 mutex_unlock(&tty_mutex);
1927 return ERR_CAST(driver);
1928 }
1929
1930 /* check whether we're reopening an existing tty */
1931 tty = tty_driver_lookup_tty(driver, filp, index);
1932 if (IS_ERR(tty)) {
1933 mutex_unlock(&tty_mutex);
1934 goto out;
1935 }
1936
1937 if (tty) {
1938 if (tty_port_kopened(tty->port)) {
1939 tty_kref_put(tty);
1940 mutex_unlock(&tty_mutex);
1941 tty = ERR_PTR(-EBUSY);
1942 goto out;
1943 }
1944 mutex_unlock(&tty_mutex);
1945 retval = tty_lock_interruptible(tty);
1946 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
1947 if (retval) {
1948 if (retval == -EINTR)
1949 retval = -ERESTARTSYS;
1950 tty = ERR_PTR(retval);
1951 goto out;
1952 }
1953 retval = tty_reopen(tty);
1954 if (retval < 0) {
1955 tty_unlock(tty);
1956 tty = ERR_PTR(retval);
1957 }
1958 } else { /* Returns with the tty_lock held for now */
1959 tty = tty_init_dev(driver, index);
1960 mutex_unlock(&tty_mutex);
1961 }
1962out:
1963 tty_driver_kref_put(driver);
1964 return tty;
1965}
1966
1967/**
1968 * tty_open - open a tty device
1969 * @inode: inode of device file
1970 * @filp: file pointer to tty
1971 *
1972 * tty_open and tty_release keep up the tty count that contains the
1973 * number of opens done on a tty. We cannot use the inode-count, as
1974 * different inodes might point to the same tty.
1975 *
1976 * Open-counting is needed for pty masters, as well as for keeping
1977 * track of serial lines: DTR is dropped when the last close happens.
1978 * (This is not done solely through tty->count, now. - Ted 1/27/92)
1979 *
1980 * The termios state of a pty is reset on first open so that
1981 * settings don't persist across reuse.
1982 *
1983 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
1984 * tty->count should protect the rest.
1985 * ->siglock protects ->signal/->sighand
1986 *
1987 * Note: the tty_unlock/lock cases without a ref are only safe due to
1988 * tty_mutex
1989 */
1990
1991static int tty_open(struct inode *inode, struct file *filp)
1992{
1993 struct tty_struct *tty;
1994 int noctty, retval;
1995 dev_t device = inode->i_rdev;
1996 unsigned saved_flags = filp->f_flags;
1997
1998 nonseekable_open(inode, filp);
1999
2000retry_open:
2001 retval = tty_alloc_file(filp);
2002 if (retval)
2003 return -ENOMEM;
2004
2005 tty = tty_open_current_tty(device, filp);
2006 if (!tty)
2007 tty = tty_open_by_driver(device, inode, filp);
2008
2009 if (IS_ERR(tty)) {
2010 tty_free_file(filp);
2011 retval = PTR_ERR(tty);
2012 if (retval != -EAGAIN || signal_pending(current))
2013 return retval;
2014 schedule();
2015 goto retry_open;
2016 }
2017
2018 tty_add_file(tty, filp);
2019
2020 check_tty_count(tty, __func__);
2021 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2022
2023 if (tty->ops->open)
2024 retval = tty->ops->open(tty, filp);
2025 else
2026 retval = -ENODEV;
2027 filp->f_flags = saved_flags;
2028
2029 if (retval) {
2030 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2031
2032 tty_unlock(tty); /* need to call tty_release without BTM */
2033 tty_release(inode, filp);
2034 if (retval != -ERESTARTSYS)
2035 return retval;
2036
2037 if (signal_pending(current))
2038 return retval;
2039
2040 schedule();
2041 /*
2042 * Need to reset f_op in case a hangup happened.
2043 */
2044 if (tty_hung_up_p(filp))
2045 filp->f_op = &tty_fops;
2046 goto retry_open;
2047 }
2048 clear_bit(TTY_HUPPED, &tty->flags);
2049
2050 noctty = (filp->f_flags & O_NOCTTY) ||
2051 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2052 device == MKDEV(TTYAUX_MAJOR, 1) ||
2053 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2054 tty->driver->subtype == PTY_TYPE_MASTER);
2055 if (!noctty)
2056 tty_open_proc_set_tty(filp, tty);
2057 tty_unlock(tty);
2058 return 0;
2059}
2060
2061
2062
2063/**
2064 * tty_poll - check tty status
2065 * @filp: file being polled
2066 * @wait: poll wait structures to update
2067 *
2068 * Call the line discipline polling method to obtain the poll
2069 * status of the device.
2070 *
2071 * Locking: locks called line discipline but ldisc poll method
2072 * may be re-entered freely by other callers.
2073 */
2074
2075static __poll_t tty_poll(struct file *filp, poll_table *wait)
2076{
2077 struct tty_struct *tty = file_tty(filp);
2078 struct tty_ldisc *ld;
2079 __poll_t ret = 0;
2080
2081 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2082 return 0;
2083
2084 ld = tty_ldisc_ref_wait(tty);
2085 if (!ld)
2086 return hung_up_tty_poll(filp, wait);
2087 if (ld->ops->poll)
2088 ret = ld->ops->poll(tty, filp, wait);
2089 tty_ldisc_deref(ld);
2090 return ret;
2091}
2092
2093static int __tty_fasync(int fd, struct file *filp, int on)
2094{
2095 struct tty_struct *tty = file_tty(filp);
2096 unsigned long flags;
2097 int retval = 0;
2098
2099 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2100 goto out;
2101
2102 retval = fasync_helper(fd, filp, on, &tty->fasync);
2103 if (retval <= 0)
2104 goto out;
2105
2106 if (on) {
2107 enum pid_type type;
2108 struct pid *pid;
2109
2110 spin_lock_irqsave(&tty->ctrl_lock, flags);
2111 if (tty->pgrp) {
2112 pid = tty->pgrp;
2113 type = PIDTYPE_PGID;
2114 } else {
2115 pid = task_pid(current);
2116 type = PIDTYPE_PID;
2117 }
2118 get_pid(pid);
2119 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2120 __f_setown(filp, pid, type, 0);
2121 put_pid(pid);
2122 retval = 0;
2123 }
2124out:
2125 return retval;
2126}
2127
2128static int tty_fasync(int fd, struct file *filp, int on)
2129{
2130 struct tty_struct *tty = file_tty(filp);
2131 int retval = -ENOTTY;
2132
2133 tty_lock(tty);
2134 if (!tty_hung_up_p(filp))
2135 retval = __tty_fasync(fd, filp, on);
2136 tty_unlock(tty);
2137
2138 return retval;
2139}
2140
2141/**
2142 * tiocsti - fake input character
2143 * @tty: tty to fake input into
2144 * @p: pointer to character
2145 *
2146 * Fake input to a tty device. Does the necessary locking and
2147 * input management.
2148 *
2149 * FIXME: does not honour flow control ??
2150 *
2151 * Locking:
2152 * Called functions take tty_ldiscs_lock
2153 * current->signal->tty check is safe without locks
2154 *
2155 * FIXME: may race normal receive processing
2156 */
2157
2158static int tiocsti(struct tty_struct *tty, char __user *p)
2159{
2160 char ch, mbz = 0;
2161 struct tty_ldisc *ld;
2162
2163 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2164 return -EPERM;
2165 if (get_user(ch, p))
2166 return -EFAULT;
2167 tty_audit_tiocsti(tty, ch);
2168 ld = tty_ldisc_ref_wait(tty);
2169 if (!ld)
2170 return -EIO;
2171 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2172 tty_ldisc_deref(ld);
2173 return 0;
2174}
2175
2176/**
2177 * tiocgwinsz - implement window query ioctl
2178 * @tty; tty
2179 * @arg: user buffer for result
2180 *
2181 * Copies the kernel idea of the window size into the user buffer.
2182 *
2183 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2184 * is consistent.
2185 */
2186
2187static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2188{
2189 int err;
2190
2191 mutex_lock(&tty->winsize_mutex);
2192 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2193 mutex_unlock(&tty->winsize_mutex);
2194
2195 return err ? -EFAULT: 0;
2196}
2197
2198/**
2199 * tty_do_resize - resize event
2200 * @tty: tty being resized
2201 * @rows: rows (character)
2202 * @cols: cols (character)
2203 *
2204 * Update the termios variables and send the necessary signals to
2205 * peform a terminal resize correctly
2206 */
2207
2208int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2209{
2210 struct pid *pgrp;
2211
2212 /* Lock the tty */
2213 mutex_lock(&tty->winsize_mutex);
2214 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2215 goto done;
2216
2217 /* Signal the foreground process group */
2218 pgrp = tty_get_pgrp(tty);
2219 if (pgrp)
2220 kill_pgrp(pgrp, SIGWINCH, 1);
2221 put_pid(pgrp);
2222
2223 tty->winsize = *ws;
2224done:
2225 mutex_unlock(&tty->winsize_mutex);
2226 return 0;
2227}
2228EXPORT_SYMBOL(tty_do_resize);
2229
2230/**
2231 * tiocswinsz - implement window size set ioctl
2232 * @tty; tty side of tty
2233 * @arg: user buffer for result
2234 *
2235 * Copies the user idea of the window size to the kernel. Traditionally
2236 * this is just advisory information but for the Linux console it
2237 * actually has driver level meaning and triggers a VC resize.
2238 *
2239 * Locking:
2240 * Driver dependent. The default do_resize method takes the
2241 * tty termios mutex and ctrl_lock. The console takes its own lock
2242 * then calls into the default method.
2243 */
2244
2245static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2246{
2247 struct winsize tmp_ws;
2248 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2249 return -EFAULT;
2250
2251 if (tty->ops->resize)
2252 return tty->ops->resize(tty, &tmp_ws);
2253 else
2254 return tty_do_resize(tty, &tmp_ws);
2255}
2256
2257/**
2258 * tioccons - allow admin to move logical console
2259 * @file: the file to become console
2260 *
2261 * Allow the administrator to move the redirected console device
2262 *
2263 * Locking: uses redirect_lock to guard the redirect information
2264 */
2265
2266static int tioccons(struct file *file)
2267{
2268 if (!capable(CAP_SYS_ADMIN))
2269 return -EPERM;
2270 if (file->f_op->write == redirected_tty_write) {
2271 struct file *f;
2272 spin_lock(&redirect_lock);
2273 f = redirect;
2274 redirect = NULL;
2275 spin_unlock(&redirect_lock);
2276 if (f)
2277 fput(f);
2278 return 0;
2279 }
2280 spin_lock(&redirect_lock);
2281 if (redirect) {
2282 spin_unlock(&redirect_lock);
2283 return -EBUSY;
2284 }
2285 redirect = get_file(file);
2286 spin_unlock(&redirect_lock);
2287 return 0;
2288}
2289
2290/**
2291 * fionbio - non blocking ioctl
2292 * @file: file to set blocking value
2293 * @p: user parameter
2294 *
2295 * Historical tty interfaces had a blocking control ioctl before
2296 * the generic functionality existed. This piece of history is preserved
2297 * in the expected tty API of posix OS's.
2298 *
2299 * Locking: none, the open file handle ensures it won't go away.
2300 */
2301
2302static int fionbio(struct file *file, int __user *p)
2303{
2304 int nonblock;
2305
2306 if (get_user(nonblock, p))
2307 return -EFAULT;
2308
2309 spin_lock(&file->f_lock);
2310 if (nonblock)
2311 file->f_flags |= O_NONBLOCK;
2312 else
2313 file->f_flags &= ~O_NONBLOCK;
2314 spin_unlock(&file->f_lock);
2315 return 0;
2316}
2317
2318/**
2319 * tiocsetd - set line discipline
2320 * @tty: tty device
2321 * @p: pointer to user data
2322 *
2323 * Set the line discipline according to user request.
2324 *
2325 * Locking: see tty_set_ldisc, this function is just a helper
2326 */
2327
2328static int tiocsetd(struct tty_struct *tty, int __user *p)
2329{
2330 int disc;
2331 int ret;
2332
2333 if (get_user(disc, p))
2334 return -EFAULT;
2335
2336 ret = tty_set_ldisc(tty, disc);
2337
2338 return ret;
2339}
2340
2341/**
2342 * tiocgetd - get line discipline
2343 * @tty: tty device
2344 * @p: pointer to user data
2345 *
2346 * Retrieves the line discipline id directly from the ldisc.
2347 *
2348 * Locking: waits for ldisc reference (in case the line discipline
2349 * is changing or the tty is being hungup)
2350 */
2351
2352static int tiocgetd(struct tty_struct *tty, int __user *p)
2353{
2354 struct tty_ldisc *ld;
2355 int ret;
2356
2357 ld = tty_ldisc_ref_wait(tty);
2358 if (!ld)
2359 return -EIO;
2360 ret = put_user(ld->ops->num, p);
2361 tty_ldisc_deref(ld);
2362 return ret;
2363}
2364
2365/**
2366 * send_break - performed time break
2367 * @tty: device to break on
2368 * @duration: timeout in mS
2369 *
2370 * Perform a timed break on hardware that lacks its own driver level
2371 * timed break functionality.
2372 *
2373 * Locking:
2374 * atomic_write_lock serializes
2375 *
2376 */
2377
2378static int send_break(struct tty_struct *tty, unsigned int duration)
2379{
2380 int retval;
2381
2382 if (tty->ops->break_ctl == NULL)
2383 return 0;
2384
2385 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2386 retval = tty->ops->break_ctl(tty, duration);
2387 else {
2388 /* Do the work ourselves */
2389 if (tty_write_lock(tty, 0) < 0)
2390 return -EINTR;
2391 retval = tty->ops->break_ctl(tty, -1);
2392 if (retval)
2393 goto out;
2394 if (!signal_pending(current))
2395 msleep_interruptible(duration);
2396 retval = tty->ops->break_ctl(tty, 0);
2397out:
2398 tty_write_unlock(tty);
2399 if (signal_pending(current))
2400 retval = -EINTR;
2401 }
2402 return retval;
2403}
2404
2405/**
2406 * tty_tiocmget - get modem status
2407 * @tty: tty device
2408 * @file: user file pointer
2409 * @p: pointer to result
2410 *
2411 * Obtain the modem status bits from the tty driver if the feature
2412 * is supported. Return -EINVAL if it is not available.
2413 *
2414 * Locking: none (up to the driver)
2415 */
2416
2417static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2418{
2419 int retval = -EINVAL;
2420
2421 if (tty->ops->tiocmget) {
2422 retval = tty->ops->tiocmget(tty);
2423
2424 if (retval >= 0)
2425 retval = put_user(retval, p);
2426 }
2427 return retval;
2428}
2429
2430/**
2431 * tty_tiocmset - set modem status
2432 * @tty: tty device
2433 * @cmd: command - clear bits, set bits or set all
2434 * @p: pointer to desired bits
2435 *
2436 * Set the modem status bits from the tty driver if the feature
2437 * is supported. Return -EINVAL if it is not available.
2438 *
2439 * Locking: none (up to the driver)
2440 */
2441
2442static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2443 unsigned __user *p)
2444{
2445 int retval;
2446 unsigned int set, clear, val;
2447
2448 if (tty->ops->tiocmset == NULL)
2449 return -EINVAL;
2450
2451 retval = get_user(val, p);
2452 if (retval)
2453 return retval;
2454 set = clear = 0;
2455 switch (cmd) {
2456 case TIOCMBIS:
2457 set = val;
2458 break;
2459 case TIOCMBIC:
2460 clear = val;
2461 break;
2462 case TIOCMSET:
2463 set = val;
2464 clear = ~val;
2465 break;
2466 }
2467 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2468 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2469 return tty->ops->tiocmset(tty, set, clear);
2470}
2471
2472static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2473{
2474 int retval = -EINVAL;
2475 struct serial_icounter_struct icount;
2476 memset(&icount, 0, sizeof(icount));
2477 if (tty->ops->get_icount)
2478 retval = tty->ops->get_icount(tty, &icount);
2479 if (retval != 0)
2480 return retval;
2481 if (copy_to_user(arg, &icount, sizeof(icount)))
2482 return -EFAULT;
2483 return 0;
2484}
2485
2486static void tty_warn_deprecated_flags(struct serial_struct __user *ss)
2487{
2488 static DEFINE_RATELIMIT_STATE(depr_flags,
2489 DEFAULT_RATELIMIT_INTERVAL,
2490 DEFAULT_RATELIMIT_BURST);
2491 char comm[TASK_COMM_LEN];
2492 int flags;
2493
2494 if (get_user(flags, &ss->flags))
2495 return;
2496
2497 flags &= ASYNC_DEPRECATED;
2498
2499 if (flags && __ratelimit(&depr_flags))
2500 pr_warn("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2501 __func__, get_task_comm(comm, current), flags);
2502}
2503
2504/*
2505 * if pty, return the slave side (real_tty)
2506 * otherwise, return self
2507 */
2508static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2509{
2510 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2511 tty->driver->subtype == PTY_TYPE_MASTER)
2512 tty = tty->link;
2513 return tty;
2514}
2515
2516/*
2517 * Split this up, as gcc can choke on it otherwise..
2518 */
2519long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2520{
2521 struct tty_struct *tty = file_tty(file);
2522 struct tty_struct *real_tty;
2523 void __user *p = (void __user *)arg;
2524 int retval;
2525 struct tty_ldisc *ld;
2526
2527 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2528 return -EINVAL;
2529
2530 real_tty = tty_pair_get_tty(tty);
2531
2532 /*
2533 * Factor out some common prep work
2534 */
2535 switch (cmd) {
2536 case TIOCSETD:
2537 case TIOCSBRK:
2538 case TIOCCBRK:
2539 case TCSBRK:
2540 case TCSBRKP:
2541 retval = tty_check_change(tty);
2542 if (retval)
2543 return retval;
2544 if (cmd != TIOCCBRK) {
2545 tty_wait_until_sent(tty, 0);
2546 if (signal_pending(current))
2547 return -EINTR;
2548 }
2549 break;
2550 }
2551
2552 /*
2553 * Now do the stuff.
2554 */
2555 switch (cmd) {
2556 case TIOCSTI:
2557 return tiocsti(tty, p);
2558 case TIOCGWINSZ:
2559 return tiocgwinsz(real_tty, p);
2560 case TIOCSWINSZ:
2561 return tiocswinsz(real_tty, p);
2562 case TIOCCONS:
2563 return real_tty != tty ? -EINVAL : tioccons(file);
2564 case FIONBIO:
2565 return fionbio(file, p);
2566 case TIOCEXCL:
2567 set_bit(TTY_EXCLUSIVE, &tty->flags);
2568 return 0;
2569 case TIOCNXCL:
2570 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2571 return 0;
2572 case TIOCGEXCL:
2573 {
2574 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2575 return put_user(excl, (int __user *)p);
2576 }
2577 case TIOCGETD:
2578 return tiocgetd(tty, p);
2579 case TIOCSETD:
2580 return tiocsetd(tty, p);
2581 case TIOCVHANGUP:
2582 if (!capable(CAP_SYS_ADMIN))
2583 return -EPERM;
2584 tty_vhangup(tty);
2585 return 0;
2586 case TIOCGDEV:
2587 {
2588 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2589 return put_user(ret, (unsigned int __user *)p);
2590 }
2591 /*
2592 * Break handling
2593 */
2594 case TIOCSBRK: /* Turn break on, unconditionally */
2595 if (tty->ops->break_ctl)
2596 return tty->ops->break_ctl(tty, -1);
2597 return 0;
2598 case TIOCCBRK: /* Turn break off, unconditionally */
2599 if (tty->ops->break_ctl)
2600 return tty->ops->break_ctl(tty, 0);
2601 return 0;
2602 case TCSBRK: /* SVID version: non-zero arg --> no break */
2603 /* non-zero arg means wait for all output data
2604 * to be sent (performed above) but don't send break.
2605 * This is used by the tcdrain() termios function.
2606 */
2607 if (!arg)
2608 return send_break(tty, 250);
2609 return 0;
2610 case TCSBRKP: /* support for POSIX tcsendbreak() */
2611 return send_break(tty, arg ? arg*100 : 250);
2612
2613 case TIOCMGET:
2614 return tty_tiocmget(tty, p);
2615 case TIOCMSET:
2616 case TIOCMBIC:
2617 case TIOCMBIS:
2618 return tty_tiocmset(tty, cmd, p);
2619 case TIOCGICOUNT:
2620 retval = tty_tiocgicount(tty, p);
2621 /* For the moment allow fall through to the old method */
2622 if (retval != -EINVAL)
2623 return retval;
2624 break;
2625 case TCFLSH:
2626 switch (arg) {
2627 case TCIFLUSH:
2628 case TCIOFLUSH:
2629 /* flush tty buffer and allow ldisc to process ioctl */
2630 tty_buffer_flush(tty, NULL);
2631 break;
2632 }
2633 break;
2634 case TIOCSSERIAL:
2635 tty_warn_deprecated_flags(p);
2636 break;
2637 case TIOCGPTPEER:
2638 /* Special because the struct file is needed */
2639 return ptm_open_peer(file, tty, (int)arg);
2640 default:
2641 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
2642 if (retval != -ENOIOCTLCMD)
2643 return retval;
2644 }
2645 if (tty->ops->ioctl) {
2646 retval = tty->ops->ioctl(tty, cmd, arg);
2647 if (retval != -ENOIOCTLCMD)
2648 return retval;
2649 }
2650 ld = tty_ldisc_ref_wait(tty);
2651 if (!ld)
2652 return hung_up_tty_ioctl(file, cmd, arg);
2653 retval = -EINVAL;
2654 if (ld->ops->ioctl) {
2655 retval = ld->ops->ioctl(tty, file, cmd, arg);
2656 if (retval == -ENOIOCTLCMD)
2657 retval = -ENOTTY;
2658 }
2659 tty_ldisc_deref(ld);
2660 return retval;
2661}
2662
2663#ifdef CONFIG_COMPAT
2664static long tty_compat_ioctl(struct file *file, unsigned int cmd,
2665 unsigned long arg)
2666{
2667 struct tty_struct *tty = file_tty(file);
2668 struct tty_ldisc *ld;
2669 int retval = -ENOIOCTLCMD;
2670
2671 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2672 return -EINVAL;
2673
2674 if (tty->ops->compat_ioctl) {
2675 retval = tty->ops->compat_ioctl(tty, cmd, arg);
2676 if (retval != -ENOIOCTLCMD)
2677 return retval;
2678 }
2679
2680 ld = tty_ldisc_ref_wait(tty);
2681 if (!ld)
2682 return hung_up_tty_compat_ioctl(file, cmd, arg);
2683 if (ld->ops->compat_ioctl)
2684 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
2685 else
2686 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
2687 tty_ldisc_deref(ld);
2688
2689 return retval;
2690}
2691#endif
2692
2693static int this_tty(const void *t, struct file *file, unsigned fd)
2694{
2695 if (likely(file->f_op->read != tty_read))
2696 return 0;
2697 return file_tty(file) != t ? 0 : fd + 1;
2698}
2699
2700/*
2701 * This implements the "Secure Attention Key" --- the idea is to
2702 * prevent trojan horses by killing all processes associated with this
2703 * tty when the user hits the "Secure Attention Key". Required for
2704 * super-paranoid applications --- see the Orange Book for more details.
2705 *
2706 * This code could be nicer; ideally it should send a HUP, wait a few
2707 * seconds, then send a INT, and then a KILL signal. But you then
2708 * have to coordinate with the init process, since all processes associated
2709 * with the current tty must be dead before the new getty is allowed
2710 * to spawn.
2711 *
2712 * Now, if it would be correct ;-/ The current code has a nasty hole -
2713 * it doesn't catch files in flight. We may send the descriptor to ourselves
2714 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2715 *
2716 * Nasty bug: do_SAK is being called in interrupt context. This can
2717 * deadlock. We punt it up to process context. AKPM - 16Mar2001
2718 */
2719void __do_SAK(struct tty_struct *tty)
2720{
2721#ifdef TTY_SOFT_SAK
2722 tty_hangup(tty);
2723#else
2724 struct task_struct *g, *p;
2725 struct pid *session;
2726 int i;
2727
2728 if (!tty)
2729 return;
2730 session = tty->session;
2731
2732 tty_ldisc_flush(tty);
2733
2734 tty_driver_flush_buffer(tty);
2735
2736 read_lock(&tasklist_lock);
2737 /* Kill the entire session */
2738 do_each_pid_task(session, PIDTYPE_SID, p) {
2739 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
2740 task_pid_nr(p), p->comm);
2741 send_sig(SIGKILL, p, 1);
2742 } while_each_pid_task(session, PIDTYPE_SID, p);
2743
2744 /* Now kill any processes that happen to have the tty open */
2745 do_each_thread(g, p) {
2746 if (p->signal->tty == tty) {
2747 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
2748 task_pid_nr(p), p->comm);
2749 send_sig(SIGKILL, p, 1);
2750 continue;
2751 }
2752 task_lock(p);
2753 i = iterate_fd(p->files, 0, this_tty, tty);
2754 if (i != 0) {
2755 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
2756 task_pid_nr(p), p->comm, i - 1);
2757 force_sig(SIGKILL, p);
2758 }
2759 task_unlock(p);
2760 } while_each_thread(g, p);
2761 read_unlock(&tasklist_lock);
2762#endif
2763}
2764
2765static void do_SAK_work(struct work_struct *work)
2766{
2767 struct tty_struct *tty =
2768 container_of(work, struct tty_struct, SAK_work);
2769 __do_SAK(tty);
2770}
2771
2772/*
2773 * The tq handling here is a little racy - tty->SAK_work may already be queued.
2774 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2775 * the values which we write to it will be identical to the values which it
2776 * already has. --akpm
2777 */
2778void do_SAK(struct tty_struct *tty)
2779{
2780 if (!tty)
2781 return;
2782 schedule_work(&tty->SAK_work);
2783}
2784
2785EXPORT_SYMBOL(do_SAK);
2786
2787static int dev_match_devt(struct device *dev, const void *data)
2788{
2789 const dev_t *devt = data;
2790 return dev->devt == *devt;
2791}
2792
2793/* Must put_device() after it's unused! */
2794static struct device *tty_get_device(struct tty_struct *tty)
2795{
2796 dev_t devt = tty_devnum(tty);
2797 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
2798}
2799
2800
2801/**
2802 * alloc_tty_struct
2803 *
2804 * This subroutine allocates and initializes a tty structure.
2805 *
2806 * Locking: none - tty in question is not exposed at this point
2807 */
2808
2809struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
2810{
2811 struct tty_struct *tty;
2812
2813 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
2814 if (!tty)
2815 return NULL;
2816
2817 kref_init(&tty->kref);
2818 tty->magic = TTY_MAGIC;
2819 if (tty_ldisc_init(tty)) {
2820 kfree(tty);
2821 return NULL;
2822 }
2823 tty->session = NULL;
2824 tty->pgrp = NULL;
2825 mutex_init(&tty->legacy_mutex);
2826 mutex_init(&tty->throttle_mutex);
2827 init_rwsem(&tty->termios_rwsem);
2828 mutex_init(&tty->winsize_mutex);
2829 init_ldsem(&tty->ldisc_sem);
2830 init_waitqueue_head(&tty->write_wait);
2831 init_waitqueue_head(&tty->read_wait);
2832 INIT_WORK(&tty->hangup_work, do_tty_hangup);
2833 mutex_init(&tty->atomic_write_lock);
2834 spin_lock_init(&tty->ctrl_lock);
2835 spin_lock_init(&tty->flow_lock);
2836 spin_lock_init(&tty->files_lock);
2837 INIT_LIST_HEAD(&tty->tty_files);
2838 INIT_WORK(&tty->SAK_work, do_SAK_work);
2839
2840 tty->driver = driver;
2841 tty->ops = driver->ops;
2842 tty->index = idx;
2843 tty_line_name(driver, idx, tty->name);
2844 tty->dev = tty_get_device(tty);
2845
2846 return tty;
2847}
2848
2849/**
2850 * tty_put_char - write one character to a tty
2851 * @tty: tty
2852 * @ch: character
2853 *
2854 * Write one byte to the tty using the provided put_char method
2855 * if present. Returns the number of characters successfully output.
2856 *
2857 * Note: the specific put_char operation in the driver layer may go
2858 * away soon. Don't call it directly, use this method
2859 */
2860
2861int tty_put_char(struct tty_struct *tty, unsigned char ch)
2862{
2863 if (tty->ops->put_char)
2864 return tty->ops->put_char(tty, ch);
2865 return tty->ops->write(tty, &ch, 1);
2866}
2867EXPORT_SYMBOL_GPL(tty_put_char);
2868
2869struct class *tty_class;
2870
2871static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
2872 unsigned int index, unsigned int count)
2873{
2874 int err;
2875
2876 /* init here, since reused cdevs cause crashes */
2877 driver->cdevs[index] = cdev_alloc();
2878 if (!driver->cdevs[index])
2879 return -ENOMEM;
2880 driver->cdevs[index]->ops = &tty_fops;
2881 driver->cdevs[index]->owner = driver->owner;
2882 err = cdev_add(driver->cdevs[index], dev, count);
2883 if (err)
2884 kobject_put(&driver->cdevs[index]->kobj);
2885 return err;
2886}
2887
2888/**
2889 * tty_register_device - register a tty device
2890 * @driver: the tty driver that describes the tty device
2891 * @index: the index in the tty driver for this tty device
2892 * @device: a struct device that is associated with this tty device.
2893 * This field is optional, if there is no known struct device
2894 * for this tty device it can be set to NULL safely.
2895 *
2896 * Returns a pointer to the struct device for this tty device
2897 * (or ERR_PTR(-EFOO) on error).
2898 *
2899 * This call is required to be made to register an individual tty device
2900 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
2901 * that bit is not set, this function should not be called by a tty
2902 * driver.
2903 *
2904 * Locking: ??
2905 */
2906
2907struct device *tty_register_device(struct tty_driver *driver, unsigned index,
2908 struct device *device)
2909{
2910 return tty_register_device_attr(driver, index, device, NULL, NULL);
2911}
2912EXPORT_SYMBOL(tty_register_device);
2913
2914static void tty_device_create_release(struct device *dev)
2915{
2916 dev_dbg(dev, "releasing...\n");
2917 kfree(dev);
2918}
2919
2920/**
2921 * tty_register_device_attr - register a tty device
2922 * @driver: the tty driver that describes the tty device
2923 * @index: the index in the tty driver for this tty device
2924 * @device: a struct device that is associated with this tty device.
2925 * This field is optional, if there is no known struct device
2926 * for this tty device it can be set to NULL safely.
2927 * @drvdata: Driver data to be set to device.
2928 * @attr_grp: Attribute group to be set on device.
2929 *
2930 * Returns a pointer to the struct device for this tty device
2931 * (or ERR_PTR(-EFOO) on error).
2932 *
2933 * This call is required to be made to register an individual tty device
2934 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
2935 * that bit is not set, this function should not be called by a tty
2936 * driver.
2937 *
2938 * Locking: ??
2939 */
2940struct device *tty_register_device_attr(struct tty_driver *driver,
2941 unsigned index, struct device *device,
2942 void *drvdata,
2943 const struct attribute_group **attr_grp)
2944{
2945 char name[64];
2946 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
2947 struct ktermios *tp;
2948 struct device *dev;
2949 int retval;
2950
2951 if (index >= driver->num) {
2952 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
2953 driver->name, index);
2954 return ERR_PTR(-EINVAL);
2955 }
2956
2957 if (driver->type == TTY_DRIVER_TYPE_PTY)
2958 pty_line_name(driver, index, name);
2959 else
2960 tty_line_name(driver, index, name);
2961
2962 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2963 if (!dev)
2964 return ERR_PTR(-ENOMEM);
2965
2966 dev->devt = devt;
2967 dev->class = tty_class;
2968 dev->parent = device;
2969 dev->release = tty_device_create_release;
2970 dev_set_name(dev, "%s", name);
2971 dev->groups = attr_grp;
2972 dev_set_drvdata(dev, drvdata);
2973
2974 dev_set_uevent_suppress(dev, 1);
2975
2976 retval = device_register(dev);
2977 if (retval)
2978 goto err_put;
2979
2980 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
2981 /*
2982 * Free any saved termios data so that the termios state is
2983 * reset when reusing a minor number.
2984 */
2985 tp = driver->termios[index];
2986 if (tp) {
2987 driver->termios[index] = NULL;
2988 kfree(tp);
2989 }
2990
2991 retval = tty_cdev_add(driver, devt, index, 1);
2992 if (retval)
2993 goto err_del;
2994 }
2995
2996 dev_set_uevent_suppress(dev, 0);
2997 kobject_uevent(&dev->kobj, KOBJ_ADD);
2998
2999 return dev;
3000
3001err_del:
3002 device_del(dev);
3003err_put:
3004 put_device(dev);
3005
3006 return ERR_PTR(retval);
3007}
3008EXPORT_SYMBOL_GPL(tty_register_device_attr);
3009
3010/**
3011 * tty_unregister_device - unregister a tty device
3012 * @driver: the tty driver that describes the tty device
3013 * @index: the index in the tty driver for this tty device
3014 *
3015 * If a tty device is registered with a call to tty_register_device() then
3016 * this function must be called when the tty device is gone.
3017 *
3018 * Locking: ??
3019 */
3020
3021void tty_unregister_device(struct tty_driver *driver, unsigned index)
3022{
3023 device_destroy(tty_class,
3024 MKDEV(driver->major, driver->minor_start) + index);
3025 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3026 cdev_del(driver->cdevs[index]);
3027 driver->cdevs[index] = NULL;
3028 }
3029}
3030EXPORT_SYMBOL(tty_unregister_device);
3031
3032/**
3033 * __tty_alloc_driver -- allocate tty driver
3034 * @lines: count of lines this driver can handle at most
3035 * @owner: module which is responsible for this driver
3036 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3037 *
3038 * This should not be called directly, some of the provided macros should be
3039 * used instead. Use IS_ERR and friends on @retval.
3040 */
3041struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3042 unsigned long flags)
3043{
3044 struct tty_driver *driver;
3045 unsigned int cdevs = 1;
3046 int err;
3047
3048 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3049 return ERR_PTR(-EINVAL);
3050
3051 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3052 if (!driver)
3053 return ERR_PTR(-ENOMEM);
3054
3055 kref_init(&driver->kref);
3056 driver->magic = TTY_DRIVER_MAGIC;
3057 driver->num = lines;
3058 driver->owner = owner;
3059 driver->flags = flags;
3060
3061 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3062 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3063 GFP_KERNEL);
3064 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3065 GFP_KERNEL);
3066 if (!driver->ttys || !driver->termios) {
3067 err = -ENOMEM;
3068 goto err_free_all;
3069 }
3070 }
3071
3072 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3073 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3074 GFP_KERNEL);
3075 if (!driver->ports) {
3076 err = -ENOMEM;
3077 goto err_free_all;
3078 }
3079 cdevs = lines;
3080 }
3081
3082 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3083 if (!driver->cdevs) {
3084 err = -ENOMEM;
3085 goto err_free_all;
3086 }
3087
3088 return driver;
3089err_free_all:
3090 kfree(driver->ports);
3091 kfree(driver->ttys);
3092 kfree(driver->termios);
3093 kfree(driver->cdevs);
3094 kfree(driver);
3095 return ERR_PTR(err);
3096}
3097EXPORT_SYMBOL(__tty_alloc_driver);
3098
3099static void destruct_tty_driver(struct kref *kref)
3100{
3101 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3102 int i;
3103 struct ktermios *tp;
3104
3105 if (driver->flags & TTY_DRIVER_INSTALLED) {
3106 for (i = 0; i < driver->num; i++) {
3107 tp = driver->termios[i];
3108 if (tp) {
3109 driver->termios[i] = NULL;
3110 kfree(tp);
3111 }
3112 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3113 tty_unregister_device(driver, i);
3114 }
3115 proc_tty_unregister_driver(driver);
3116 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3117 cdev_del(driver->cdevs[0]);
3118 }
3119 kfree(driver->cdevs);
3120 kfree(driver->ports);
3121 kfree(driver->termios);
3122 kfree(driver->ttys);
3123 kfree(driver);
3124}
3125
3126void tty_driver_kref_put(struct tty_driver *driver)
3127{
3128 kref_put(&driver->kref, destruct_tty_driver);
3129}
3130EXPORT_SYMBOL(tty_driver_kref_put);
3131
3132void tty_set_operations(struct tty_driver *driver,
3133 const struct tty_operations *op)
3134{
3135 driver->ops = op;
3136};
3137EXPORT_SYMBOL(tty_set_operations);
3138
3139void put_tty_driver(struct tty_driver *d)
3140{
3141 tty_driver_kref_put(d);
3142}
3143EXPORT_SYMBOL(put_tty_driver);
3144
3145/*
3146 * Called by a tty driver to register itself.
3147 */
3148int tty_register_driver(struct tty_driver *driver)
3149{
3150 int error;
3151 int i;
3152 dev_t dev;
3153 struct device *d;
3154
3155 if (!driver->major) {
3156 error = alloc_chrdev_region(&dev, driver->minor_start,
3157 driver->num, driver->name);
3158 if (!error) {
3159 driver->major = MAJOR(dev);
3160 driver->minor_start = MINOR(dev);
3161 }
3162 } else {
3163 dev = MKDEV(driver->major, driver->minor_start);
3164 error = register_chrdev_region(dev, driver->num, driver->name);
3165 }
3166 if (error < 0)
3167 goto err;
3168
3169 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3170 error = tty_cdev_add(driver, dev, 0, driver->num);
3171 if (error)
3172 goto err_unreg_char;
3173 }
3174
3175 mutex_lock(&tty_mutex);
3176 list_add(&driver->tty_drivers, &tty_drivers);
3177 mutex_unlock(&tty_mutex);
3178
3179 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3180 for (i = 0; i < driver->num; i++) {
3181 d = tty_register_device(driver, i, NULL);
3182 if (IS_ERR(d)) {
3183 error = PTR_ERR(d);
3184 goto err_unreg_devs;
3185 }
3186 }
3187 }
3188 proc_tty_register_driver(driver);
3189 driver->flags |= TTY_DRIVER_INSTALLED;
3190 return 0;
3191
3192err_unreg_devs:
3193 for (i--; i >= 0; i--)
3194 tty_unregister_device(driver, i);
3195
3196 mutex_lock(&tty_mutex);
3197 list_del(&driver->tty_drivers);
3198 mutex_unlock(&tty_mutex);
3199
3200err_unreg_char:
3201 unregister_chrdev_region(dev, driver->num);
3202err:
3203 return error;
3204}
3205EXPORT_SYMBOL(tty_register_driver);
3206
3207/*
3208 * Called by a tty driver to unregister itself.
3209 */
3210int tty_unregister_driver(struct tty_driver *driver)
3211{
3212#if 0
3213 /* FIXME */
3214 if (driver->refcount)
3215 return -EBUSY;
3216#endif
3217 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3218 driver->num);
3219 mutex_lock(&tty_mutex);
3220 list_del(&driver->tty_drivers);
3221 mutex_unlock(&tty_mutex);
3222 return 0;
3223}
3224
3225EXPORT_SYMBOL(tty_unregister_driver);
3226
3227dev_t tty_devnum(struct tty_struct *tty)
3228{
3229 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3230}
3231EXPORT_SYMBOL(tty_devnum);
3232
3233void tty_default_fops(struct file_operations *fops)
3234{
3235 *fops = tty_fops;
3236}
3237
3238static char *tty_devnode(struct device *dev, umode_t *mode)
3239{
3240 if (!mode)
3241 return NULL;
3242 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3243 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3244 *mode = 0666;
3245 return NULL;
3246}
3247
3248static int __init tty_class_init(void)
3249{
3250 tty_class = class_create(THIS_MODULE, "tty");
3251 if (IS_ERR(tty_class))
3252 return PTR_ERR(tty_class);
3253 tty_class->devnode = tty_devnode;
3254 return 0;
3255}
3256
3257postcore_initcall(tty_class_init);
3258
3259/* 3/2004 jmc: why do these devices exist? */
3260static struct cdev tty_cdev, console_cdev;
3261
3262static ssize_t show_cons_active(struct device *dev,
3263 struct device_attribute *attr, char *buf)
3264{
3265 struct console *cs[16];
3266 int i = 0;
3267 struct console *c;
3268 ssize_t count = 0;
3269
3270 console_lock();
3271 for_each_console(c) {
3272 if (!c->device)
3273 continue;
3274 if (!c->write)
3275 continue;
3276 if ((c->flags & CON_ENABLED) == 0)
3277 continue;
3278 cs[i++] = c;
3279 if (i >= ARRAY_SIZE(cs))
3280 break;
3281 }
3282 while (i--) {
3283 int index = cs[i]->index;
3284 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3285
3286 /* don't resolve tty0 as some programs depend on it */
3287 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3288 count += tty_line_name(drv, index, buf + count);
3289 else
3290 count += sprintf(buf + count, "%s%d",
3291 cs[i]->name, cs[i]->index);
3292
3293 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3294 }
3295 console_unlock();
3296
3297 return count;
3298}
3299static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3300
3301static struct attribute *cons_dev_attrs[] = {
3302 &dev_attr_active.attr,
3303 NULL
3304};
3305
3306ATTRIBUTE_GROUPS(cons_dev);
3307
3308static struct device *consdev;
3309
3310void console_sysfs_notify(void)
3311{
3312 if (consdev)
3313 sysfs_notify(&consdev->kobj, NULL, "active");
3314}
3315
3316/*
3317 * Ok, now we can initialize the rest of the tty devices and can count
3318 * on memory allocations, interrupts etc..
3319 */
3320int __init tty_init(void)
3321{
3322 cdev_init(&tty_cdev, &tty_fops);
3323 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3324 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3325 panic("Couldn't register /dev/tty driver\n");
3326 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3327
3328 cdev_init(&console_cdev, &console_fops);
3329 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3330 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3331 panic("Couldn't register /dev/console driver\n");
3332 consdev = device_create_with_groups(tty_class, NULL,
3333 MKDEV(TTYAUX_MAJOR, 1), NULL,
3334 cons_dev_groups, "console");
3335 if (IS_ERR(consdev))
3336 consdev = NULL;
3337
3338#ifdef CONFIG_VT
3339 vty_init(&console_fops);
3340#endif
3341 return 0;
3342}
3343
1/*
2 * Copyright (C) 1991, 1992 Linus Torvalds
3 */
4
5/*
6 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
7 * or rs-channels. It also implements echoing, cooked mode etc.
8 *
9 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
10 *
11 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
12 * tty_struct and tty_queue structures. Previously there was an array
13 * of 256 tty_struct's which was statically allocated, and the
14 * tty_queue structures were allocated at boot time. Both are now
15 * dynamically allocated only when the tty is open.
16 *
17 * Also restructured routines so that there is more of a separation
18 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
19 * the low-level tty routines (serial.c, pty.c, console.c). This
20 * makes for cleaner and more compact code. -TYT, 9/17/92
21 *
22 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
23 * which can be dynamically activated and de-activated by the line
24 * discipline handling modules (like SLIP).
25 *
26 * NOTE: pay no attention to the line discipline code (yet); its
27 * interface is still subject to change in this version...
28 * -- TYT, 1/31/92
29 *
30 * Added functionality to the OPOST tty handling. No delays, but all
31 * other bits should be there.
32 * -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
33 *
34 * Rewrote canonical mode and added more termios flags.
35 * -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
36 *
37 * Reorganized FASYNC support so mouse code can share it.
38 * -- ctm@ardi.com, 9Sep95
39 *
40 * New TIOCLINUX variants added.
41 * -- mj@k332.feld.cvut.cz, 19-Nov-95
42 *
43 * Restrict vt switching via ioctl()
44 * -- grif@cs.ucr.edu, 5-Dec-95
45 *
46 * Move console and virtual terminal code to more appropriate files,
47 * implement CONFIG_VT and generalize console device interface.
48 * -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
49 *
50 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
51 * -- Bill Hawes <whawes@star.net>, June 97
52 *
53 * Added devfs support.
54 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
55 *
56 * Added support for a Unix98-style ptmx device.
57 * -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
58 *
59 * Reduced memory usage for older ARM systems
60 * -- Russell King <rmk@arm.linux.org.uk>
61 *
62 * Move do_SAK() into process context. Less stack use in devfs functions.
63 * alloc_tty_struct() always uses kmalloc()
64 * -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
65 */
66
67#include <linux/types.h>
68#include <linux/major.h>
69#include <linux/errno.h>
70#include <linux/signal.h>
71#include <linux/fcntl.h>
72#include <linux/sched.h>
73#include <linux/interrupt.h>
74#include <linux/tty.h>
75#include <linux/tty_driver.h>
76#include <linux/tty_flip.h>
77#include <linux/devpts_fs.h>
78#include <linux/file.h>
79#include <linux/fdtable.h>
80#include <linux/console.h>
81#include <linux/timer.h>
82#include <linux/ctype.h>
83#include <linux/kd.h>
84#include <linux/mm.h>
85#include <linux/string.h>
86#include <linux/slab.h>
87#include <linux/poll.h>
88#include <linux/proc_fs.h>
89#include <linux/init.h>
90#include <linux/module.h>
91#include <linux/device.h>
92#include <linux/wait.h>
93#include <linux/bitops.h>
94#include <linux/delay.h>
95#include <linux/seq_file.h>
96#include <linux/serial.h>
97#include <linux/ratelimit.h>
98
99#include <linux/uaccess.h>
100
101#include <linux/kbd_kern.h>
102#include <linux/vt_kern.h>
103#include <linux/selection.h>
104
105#include <linux/kmod.h>
106#include <linux/nsproxy.h>
107
108#undef TTY_DEBUG_HANGUP
109#ifdef TTY_DEBUG_HANGUP
110# define tty_debug_hangup(tty, f, args...) tty_debug(tty, f, ##args)
111#else
112# define tty_debug_hangup(tty, f, args...) do { } while (0)
113#endif
114
115#define TTY_PARANOIA_CHECK 1
116#define CHECK_TTY_COUNT 1
117
118struct ktermios tty_std_termios = { /* for the benefit of tty drivers */
119 .c_iflag = ICRNL | IXON,
120 .c_oflag = OPOST | ONLCR,
121 .c_cflag = B38400 | CS8 | CREAD | HUPCL,
122 .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
123 ECHOCTL | ECHOKE | IEXTEN,
124 .c_cc = INIT_C_CC,
125 .c_ispeed = 38400,
126 .c_ospeed = 38400,
127 /* .c_line = N_TTY, */
128};
129
130EXPORT_SYMBOL(tty_std_termios);
131
132/* This list gets poked at by procfs and various bits of boot up code. This
133 could do with some rationalisation such as pulling the tty proc function
134 into this file */
135
136LIST_HEAD(tty_drivers); /* linked list of tty drivers */
137
138/* Mutex to protect creating and releasing a tty */
139DEFINE_MUTEX(tty_mutex);
140
141static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
142static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
143ssize_t redirected_tty_write(struct file *, const char __user *,
144 size_t, loff_t *);
145static unsigned int tty_poll(struct file *, poll_table *);
146static int tty_open(struct inode *, struct file *);
147long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
148#ifdef CONFIG_COMPAT
149static long tty_compat_ioctl(struct file *file, unsigned int cmd,
150 unsigned long arg);
151#else
152#define tty_compat_ioctl NULL
153#endif
154static int __tty_fasync(int fd, struct file *filp, int on);
155static int tty_fasync(int fd, struct file *filp, int on);
156static void release_tty(struct tty_struct *tty, int idx);
157
158/**
159 * free_tty_struct - free a disused tty
160 * @tty: tty struct to free
161 *
162 * Free the write buffers, tty queue and tty memory itself.
163 *
164 * Locking: none. Must be called after tty is definitely unused
165 */
166
167static void free_tty_struct(struct tty_struct *tty)
168{
169 tty_ldisc_deinit(tty);
170 put_device(tty->dev);
171 kfree(tty->write_buf);
172 tty->magic = 0xDEADDEAD;
173 kfree(tty);
174}
175
176static inline struct tty_struct *file_tty(struct file *file)
177{
178 return ((struct tty_file_private *)file->private_data)->tty;
179}
180
181int tty_alloc_file(struct file *file)
182{
183 struct tty_file_private *priv;
184
185 priv = kmalloc(sizeof(*priv), GFP_KERNEL);
186 if (!priv)
187 return -ENOMEM;
188
189 file->private_data = priv;
190
191 return 0;
192}
193
194/* Associate a new file with the tty structure */
195void tty_add_file(struct tty_struct *tty, struct file *file)
196{
197 struct tty_file_private *priv = file->private_data;
198
199 priv->tty = tty;
200 priv->file = file;
201
202 spin_lock(&tty->files_lock);
203 list_add(&priv->list, &tty->tty_files);
204 spin_unlock(&tty->files_lock);
205}
206
207/**
208 * tty_free_file - free file->private_data
209 *
210 * This shall be used only for fail path handling when tty_add_file was not
211 * called yet.
212 */
213void tty_free_file(struct file *file)
214{
215 struct tty_file_private *priv = file->private_data;
216
217 file->private_data = NULL;
218 kfree(priv);
219}
220
221/* Delete file from its tty */
222static void tty_del_file(struct file *file)
223{
224 struct tty_file_private *priv = file->private_data;
225 struct tty_struct *tty = priv->tty;
226
227 spin_lock(&tty->files_lock);
228 list_del(&priv->list);
229 spin_unlock(&tty->files_lock);
230 tty_free_file(file);
231}
232
233
234#define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
235
236/**
237 * tty_name - return tty naming
238 * @tty: tty structure
239 *
240 * Convert a tty structure into a name. The name reflects the kernel
241 * naming policy and if udev is in use may not reflect user space
242 *
243 * Locking: none
244 */
245
246const char *tty_name(const struct tty_struct *tty)
247{
248 if (!tty) /* Hmm. NULL pointer. That's fun. */
249 return "NULL tty";
250 return tty->name;
251}
252
253EXPORT_SYMBOL(tty_name);
254
255const char *tty_driver_name(const struct tty_struct *tty)
256{
257 if (!tty || !tty->driver)
258 return "";
259 return tty->driver->name;
260}
261
262static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
263 const char *routine)
264{
265#ifdef TTY_PARANOIA_CHECK
266 if (!tty) {
267 pr_warn("(%d:%d): %s: NULL tty\n",
268 imajor(inode), iminor(inode), routine);
269 return 1;
270 }
271 if (tty->magic != TTY_MAGIC) {
272 pr_warn("(%d:%d): %s: bad magic number\n",
273 imajor(inode), iminor(inode), routine);
274 return 1;
275 }
276#endif
277 return 0;
278}
279
280/* Caller must hold tty_lock */
281static int check_tty_count(struct tty_struct *tty, const char *routine)
282{
283#ifdef CHECK_TTY_COUNT
284 struct list_head *p;
285 int count = 0;
286
287 spin_lock(&tty->files_lock);
288 list_for_each(p, &tty->tty_files) {
289 count++;
290 }
291 spin_unlock(&tty->files_lock);
292 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
293 tty->driver->subtype == PTY_TYPE_SLAVE &&
294 tty->link && tty->link->count)
295 count++;
296 if (tty->count != count) {
297 tty_warn(tty, "%s: tty->count(%d) != #fd's(%d)\n",
298 routine, tty->count, count);
299 return count;
300 }
301#endif
302 return 0;
303}
304
305/**
306 * get_tty_driver - find device of a tty
307 * @dev_t: device identifier
308 * @index: returns the index of the tty
309 *
310 * This routine returns a tty driver structure, given a device number
311 * and also passes back the index number.
312 *
313 * Locking: caller must hold tty_mutex
314 */
315
316static struct tty_driver *get_tty_driver(dev_t device, int *index)
317{
318 struct tty_driver *p;
319
320 list_for_each_entry(p, &tty_drivers, tty_drivers) {
321 dev_t base = MKDEV(p->major, p->minor_start);
322 if (device < base || device >= base + p->num)
323 continue;
324 *index = device - base;
325 return tty_driver_kref_get(p);
326 }
327 return NULL;
328}
329
330#ifdef CONFIG_CONSOLE_POLL
331
332/**
333 * tty_find_polling_driver - find device of a polled tty
334 * @name: name string to match
335 * @line: pointer to resulting tty line nr
336 *
337 * This routine returns a tty driver structure, given a name
338 * and the condition that the tty driver is capable of polled
339 * operation.
340 */
341struct tty_driver *tty_find_polling_driver(char *name, int *line)
342{
343 struct tty_driver *p, *res = NULL;
344 int tty_line = 0;
345 int len;
346 char *str, *stp;
347
348 for (str = name; *str; str++)
349 if ((*str >= '0' && *str <= '9') || *str == ',')
350 break;
351 if (!*str)
352 return NULL;
353
354 len = str - name;
355 tty_line = simple_strtoul(str, &str, 10);
356
357 mutex_lock(&tty_mutex);
358 /* Search through the tty devices to look for a match */
359 list_for_each_entry(p, &tty_drivers, tty_drivers) {
360 if (strncmp(name, p->name, len) != 0)
361 continue;
362 stp = str;
363 if (*stp == ',')
364 stp++;
365 if (*stp == '\0')
366 stp = NULL;
367
368 if (tty_line >= 0 && tty_line < p->num && p->ops &&
369 p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
370 res = tty_driver_kref_get(p);
371 *line = tty_line;
372 break;
373 }
374 }
375 mutex_unlock(&tty_mutex);
376
377 return res;
378}
379EXPORT_SYMBOL_GPL(tty_find_polling_driver);
380#endif
381
382static int is_ignored(int sig)
383{
384 return (sigismember(¤t->blocked, sig) ||
385 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
386}
387
388/**
389 * tty_check_change - check for POSIX terminal changes
390 * @tty: tty to check
391 *
392 * If we try to write to, or set the state of, a terminal and we're
393 * not in the foreground, send a SIGTTOU. If the signal is blocked or
394 * ignored, go ahead and perform the operation. (POSIX 7.2)
395 *
396 * Locking: ctrl_lock
397 */
398
399int __tty_check_change(struct tty_struct *tty, int sig)
400{
401 unsigned long flags;
402 struct pid *pgrp, *tty_pgrp;
403 int ret = 0;
404
405 if (current->signal->tty != tty)
406 return 0;
407
408 rcu_read_lock();
409 pgrp = task_pgrp(current);
410
411 spin_lock_irqsave(&tty->ctrl_lock, flags);
412 tty_pgrp = tty->pgrp;
413 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
414
415 if (tty_pgrp && pgrp != tty->pgrp) {
416 if (is_ignored(sig)) {
417 if (sig == SIGTTIN)
418 ret = -EIO;
419 } else if (is_current_pgrp_orphaned())
420 ret = -EIO;
421 else {
422 kill_pgrp(pgrp, sig, 1);
423 set_thread_flag(TIF_SIGPENDING);
424 ret = -ERESTARTSYS;
425 }
426 }
427 rcu_read_unlock();
428
429 if (!tty_pgrp)
430 tty_warn(tty, "sig=%d, tty->pgrp == NULL!\n", sig);
431
432 return ret;
433}
434
435int tty_check_change(struct tty_struct *tty)
436{
437 return __tty_check_change(tty, SIGTTOU);
438}
439EXPORT_SYMBOL(tty_check_change);
440
441static ssize_t hung_up_tty_read(struct file *file, char __user *buf,
442 size_t count, loff_t *ppos)
443{
444 return 0;
445}
446
447static ssize_t hung_up_tty_write(struct file *file, const char __user *buf,
448 size_t count, loff_t *ppos)
449{
450 return -EIO;
451}
452
453/* No kernel lock held - none needed ;) */
454static unsigned int hung_up_tty_poll(struct file *filp, poll_table *wait)
455{
456 return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
457}
458
459static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
460 unsigned long arg)
461{
462 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
463}
464
465static long hung_up_tty_compat_ioctl(struct file *file,
466 unsigned int cmd, unsigned long arg)
467{
468 return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
469}
470
471static int hung_up_tty_fasync(int fd, struct file *file, int on)
472{
473 return -ENOTTY;
474}
475
476static const struct file_operations tty_fops = {
477 .llseek = no_llseek,
478 .read = tty_read,
479 .write = tty_write,
480 .poll = tty_poll,
481 .unlocked_ioctl = tty_ioctl,
482 .compat_ioctl = tty_compat_ioctl,
483 .open = tty_open,
484 .release = tty_release,
485 .fasync = tty_fasync,
486};
487
488static const struct file_operations console_fops = {
489 .llseek = no_llseek,
490 .read = tty_read,
491 .write = redirected_tty_write,
492 .poll = tty_poll,
493 .unlocked_ioctl = tty_ioctl,
494 .compat_ioctl = tty_compat_ioctl,
495 .open = tty_open,
496 .release = tty_release,
497 .fasync = tty_fasync,
498};
499
500static const struct file_operations hung_up_tty_fops = {
501 .llseek = no_llseek,
502 .read = hung_up_tty_read,
503 .write = hung_up_tty_write,
504 .poll = hung_up_tty_poll,
505 .unlocked_ioctl = hung_up_tty_ioctl,
506 .compat_ioctl = hung_up_tty_compat_ioctl,
507 .release = tty_release,
508 .fasync = hung_up_tty_fasync,
509};
510
511static DEFINE_SPINLOCK(redirect_lock);
512static struct file *redirect;
513
514
515void proc_clear_tty(struct task_struct *p)
516{
517 unsigned long flags;
518 struct tty_struct *tty;
519 spin_lock_irqsave(&p->sighand->siglock, flags);
520 tty = p->signal->tty;
521 p->signal->tty = NULL;
522 spin_unlock_irqrestore(&p->sighand->siglock, flags);
523 tty_kref_put(tty);
524}
525
526/**
527 * proc_set_tty - set the controlling terminal
528 *
529 * Only callable by the session leader and only if it does not already have
530 * a controlling terminal.
531 *
532 * Caller must hold: tty_lock()
533 * a readlock on tasklist_lock
534 * sighand lock
535 */
536static void __proc_set_tty(struct tty_struct *tty)
537{
538 unsigned long flags;
539
540 spin_lock_irqsave(&tty->ctrl_lock, flags);
541 /*
542 * The session and fg pgrp references will be non-NULL if
543 * tiocsctty() is stealing the controlling tty
544 */
545 put_pid(tty->session);
546 put_pid(tty->pgrp);
547 tty->pgrp = get_pid(task_pgrp(current));
548 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
549 tty->session = get_pid(task_session(current));
550 if (current->signal->tty) {
551 tty_debug(tty, "current tty %s not NULL!!\n",
552 current->signal->tty->name);
553 tty_kref_put(current->signal->tty);
554 }
555 put_pid(current->signal->tty_old_pgrp);
556 current->signal->tty = tty_kref_get(tty);
557 current->signal->tty_old_pgrp = NULL;
558}
559
560static void proc_set_tty(struct tty_struct *tty)
561{
562 spin_lock_irq(¤t->sighand->siglock);
563 __proc_set_tty(tty);
564 spin_unlock_irq(¤t->sighand->siglock);
565}
566
567struct tty_struct *get_current_tty(void)
568{
569 struct tty_struct *tty;
570 unsigned long flags;
571
572 spin_lock_irqsave(¤t->sighand->siglock, flags);
573 tty = tty_kref_get(current->signal->tty);
574 spin_unlock_irqrestore(¤t->sighand->siglock, flags);
575 return tty;
576}
577EXPORT_SYMBOL_GPL(get_current_tty);
578
579static void session_clear_tty(struct pid *session)
580{
581 struct task_struct *p;
582 do_each_pid_task(session, PIDTYPE_SID, p) {
583 proc_clear_tty(p);
584 } while_each_pid_task(session, PIDTYPE_SID, p);
585}
586
587/**
588 * tty_wakeup - request more data
589 * @tty: terminal
590 *
591 * Internal and external helper for wakeups of tty. This function
592 * informs the line discipline if present that the driver is ready
593 * to receive more output data.
594 */
595
596void tty_wakeup(struct tty_struct *tty)
597{
598 struct tty_ldisc *ld;
599
600 if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
601 ld = tty_ldisc_ref(tty);
602 if (ld) {
603 if (ld->ops->write_wakeup)
604 ld->ops->write_wakeup(tty);
605 tty_ldisc_deref(ld);
606 }
607 }
608 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
609}
610
611EXPORT_SYMBOL_GPL(tty_wakeup);
612
613/**
614 * tty_signal_session_leader - sends SIGHUP to session leader
615 * @tty controlling tty
616 * @exit_session if non-zero, signal all foreground group processes
617 *
618 * Send SIGHUP and SIGCONT to the session leader and its process group.
619 * Optionally, signal all processes in the foreground process group.
620 *
621 * Returns the number of processes in the session with this tty
622 * as their controlling terminal. This value is used to drop
623 * tty references for those processes.
624 */
625static int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
626{
627 struct task_struct *p;
628 int refs = 0;
629 struct pid *tty_pgrp = NULL;
630
631 read_lock(&tasklist_lock);
632 if (tty->session) {
633 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
634 spin_lock_irq(&p->sighand->siglock);
635 if (p->signal->tty == tty) {
636 p->signal->tty = NULL;
637 /* We defer the dereferences outside fo
638 the tasklist lock */
639 refs++;
640 }
641 if (!p->signal->leader) {
642 spin_unlock_irq(&p->sighand->siglock);
643 continue;
644 }
645 __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
646 __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
647 put_pid(p->signal->tty_old_pgrp); /* A noop */
648 spin_lock(&tty->ctrl_lock);
649 tty_pgrp = get_pid(tty->pgrp);
650 if (tty->pgrp)
651 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
652 spin_unlock(&tty->ctrl_lock);
653 spin_unlock_irq(&p->sighand->siglock);
654 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
655 }
656 read_unlock(&tasklist_lock);
657
658 if (tty_pgrp) {
659 if (exit_session)
660 kill_pgrp(tty_pgrp, SIGHUP, exit_session);
661 put_pid(tty_pgrp);
662 }
663
664 return refs;
665}
666
667/**
668 * __tty_hangup - actual handler for hangup events
669 * @work: tty device
670 *
671 * This can be called by a "kworker" kernel thread. That is process
672 * synchronous but doesn't hold any locks, so we need to make sure we
673 * have the appropriate locks for what we're doing.
674 *
675 * The hangup event clears any pending redirections onto the hung up
676 * device. It ensures future writes will error and it does the needed
677 * line discipline hangup and signal delivery. The tty object itself
678 * remains intact.
679 *
680 * Locking:
681 * BTM
682 * redirect lock for undoing redirection
683 * file list lock for manipulating list of ttys
684 * tty_ldiscs_lock from called functions
685 * termios_rwsem resetting termios data
686 * tasklist_lock to walk task list for hangup event
687 * ->siglock to protect ->signal/->sighand
688 */
689static void __tty_hangup(struct tty_struct *tty, int exit_session)
690{
691 struct file *cons_filp = NULL;
692 struct file *filp, *f = NULL;
693 struct tty_file_private *priv;
694 int closecount = 0, n;
695 int refs;
696
697 if (!tty)
698 return;
699
700
701 spin_lock(&redirect_lock);
702 if (redirect && file_tty(redirect) == tty) {
703 f = redirect;
704 redirect = NULL;
705 }
706 spin_unlock(&redirect_lock);
707
708 tty_lock(tty);
709
710 if (test_bit(TTY_HUPPED, &tty->flags)) {
711 tty_unlock(tty);
712 return;
713 }
714
715 /* inuse_filps is protected by the single tty lock,
716 this really needs to change if we want to flush the
717 workqueue with the lock held */
718 check_tty_count(tty, "tty_hangup");
719
720 spin_lock(&tty->files_lock);
721 /* This breaks for file handles being sent over AF_UNIX sockets ? */
722 list_for_each_entry(priv, &tty->tty_files, list) {
723 filp = priv->file;
724 if (filp->f_op->write == redirected_tty_write)
725 cons_filp = filp;
726 if (filp->f_op->write != tty_write)
727 continue;
728 closecount++;
729 __tty_fasync(-1, filp, 0); /* can't block */
730 filp->f_op = &hung_up_tty_fops;
731 }
732 spin_unlock(&tty->files_lock);
733
734 refs = tty_signal_session_leader(tty, exit_session);
735 /* Account for the p->signal references we killed */
736 while (refs--)
737 tty_kref_put(tty);
738
739 tty_ldisc_hangup(tty, cons_filp != NULL);
740
741 spin_lock_irq(&tty->ctrl_lock);
742 clear_bit(TTY_THROTTLED, &tty->flags);
743 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
744 put_pid(tty->session);
745 put_pid(tty->pgrp);
746 tty->session = NULL;
747 tty->pgrp = NULL;
748 tty->ctrl_status = 0;
749 spin_unlock_irq(&tty->ctrl_lock);
750
751 /*
752 * If one of the devices matches a console pointer, we
753 * cannot just call hangup() because that will cause
754 * tty->count and state->count to go out of sync.
755 * So we just call close() the right number of times.
756 */
757 if (cons_filp) {
758 if (tty->ops->close)
759 for (n = 0; n < closecount; n++)
760 tty->ops->close(tty, cons_filp);
761 } else if (tty->ops->hangup)
762 tty->ops->hangup(tty);
763 /*
764 * We don't want to have driver/ldisc interactions beyond the ones
765 * we did here. The driver layer expects no calls after ->hangup()
766 * from the ldisc side, which is now guaranteed.
767 */
768 set_bit(TTY_HUPPED, &tty->flags);
769 tty_unlock(tty);
770
771 if (f)
772 fput(f);
773}
774
775static void do_tty_hangup(struct work_struct *work)
776{
777 struct tty_struct *tty =
778 container_of(work, struct tty_struct, hangup_work);
779
780 __tty_hangup(tty, 0);
781}
782
783/**
784 * tty_hangup - trigger a hangup event
785 * @tty: tty to hangup
786 *
787 * A carrier loss (virtual or otherwise) has occurred on this like
788 * schedule a hangup sequence to run after this event.
789 */
790
791void tty_hangup(struct tty_struct *tty)
792{
793 tty_debug_hangup(tty, "hangup\n");
794 schedule_work(&tty->hangup_work);
795}
796
797EXPORT_SYMBOL(tty_hangup);
798
799/**
800 * tty_vhangup - process vhangup
801 * @tty: tty to hangup
802 *
803 * The user has asked via system call for the terminal to be hung up.
804 * We do this synchronously so that when the syscall returns the process
805 * is complete. That guarantee is necessary for security reasons.
806 */
807
808void tty_vhangup(struct tty_struct *tty)
809{
810 tty_debug_hangup(tty, "vhangup\n");
811 __tty_hangup(tty, 0);
812}
813
814EXPORT_SYMBOL(tty_vhangup);
815
816
817/**
818 * tty_vhangup_self - process vhangup for own ctty
819 *
820 * Perform a vhangup on the current controlling tty
821 */
822
823void tty_vhangup_self(void)
824{
825 struct tty_struct *tty;
826
827 tty = get_current_tty();
828 if (tty) {
829 tty_vhangup(tty);
830 tty_kref_put(tty);
831 }
832}
833
834/**
835 * tty_vhangup_session - hangup session leader exit
836 * @tty: tty to hangup
837 *
838 * The session leader is exiting and hanging up its controlling terminal.
839 * Every process in the foreground process group is signalled SIGHUP.
840 *
841 * We do this synchronously so that when the syscall returns the process
842 * is complete. That guarantee is necessary for security reasons.
843 */
844
845static void tty_vhangup_session(struct tty_struct *tty)
846{
847 tty_debug_hangup(tty, "session hangup\n");
848 __tty_hangup(tty, 1);
849}
850
851/**
852 * tty_hung_up_p - was tty hung up
853 * @filp: file pointer of tty
854 *
855 * Return true if the tty has been subject to a vhangup or a carrier
856 * loss
857 */
858
859int tty_hung_up_p(struct file *filp)
860{
861 return (filp->f_op == &hung_up_tty_fops);
862}
863
864EXPORT_SYMBOL(tty_hung_up_p);
865
866/**
867 * disassociate_ctty - disconnect controlling tty
868 * @on_exit: true if exiting so need to "hang up" the session
869 *
870 * This function is typically called only by the session leader, when
871 * it wants to disassociate itself from its controlling tty.
872 *
873 * It performs the following functions:
874 * (1) Sends a SIGHUP and SIGCONT to the foreground process group
875 * (2) Clears the tty from being controlling the session
876 * (3) Clears the controlling tty for all processes in the
877 * session group.
878 *
879 * The argument on_exit is set to 1 if called when a process is
880 * exiting; it is 0 if called by the ioctl TIOCNOTTY.
881 *
882 * Locking:
883 * BTM is taken for hysterical raisins, and held when
884 * called from no_tty().
885 * tty_mutex is taken to protect tty
886 * ->siglock is taken to protect ->signal/->sighand
887 * tasklist_lock is taken to walk process list for sessions
888 * ->siglock is taken to protect ->signal/->sighand
889 */
890
891void disassociate_ctty(int on_exit)
892{
893 struct tty_struct *tty;
894
895 if (!current->signal->leader)
896 return;
897
898 tty = get_current_tty();
899 if (tty) {
900 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) {
901 tty_vhangup_session(tty);
902 } else {
903 struct pid *tty_pgrp = tty_get_pgrp(tty);
904 if (tty_pgrp) {
905 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
906 if (!on_exit)
907 kill_pgrp(tty_pgrp, SIGCONT, on_exit);
908 put_pid(tty_pgrp);
909 }
910 }
911 tty_kref_put(tty);
912
913 } else if (on_exit) {
914 struct pid *old_pgrp;
915 spin_lock_irq(¤t->sighand->siglock);
916 old_pgrp = current->signal->tty_old_pgrp;
917 current->signal->tty_old_pgrp = NULL;
918 spin_unlock_irq(¤t->sighand->siglock);
919 if (old_pgrp) {
920 kill_pgrp(old_pgrp, SIGHUP, on_exit);
921 kill_pgrp(old_pgrp, SIGCONT, on_exit);
922 put_pid(old_pgrp);
923 }
924 return;
925 }
926
927 spin_lock_irq(¤t->sighand->siglock);
928 put_pid(current->signal->tty_old_pgrp);
929 current->signal->tty_old_pgrp = NULL;
930
931 tty = tty_kref_get(current->signal->tty);
932 if (tty) {
933 unsigned long flags;
934 spin_lock_irqsave(&tty->ctrl_lock, flags);
935 put_pid(tty->session);
936 put_pid(tty->pgrp);
937 tty->session = NULL;
938 tty->pgrp = NULL;
939 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
940 tty_kref_put(tty);
941 } else
942 tty_debug_hangup(tty, "no current tty\n");
943
944 spin_unlock_irq(¤t->sighand->siglock);
945 /* Now clear signal->tty under the lock */
946 read_lock(&tasklist_lock);
947 session_clear_tty(task_session(current));
948 read_unlock(&tasklist_lock);
949}
950
951/**
952 *
953 * no_tty - Ensure the current process does not have a controlling tty
954 */
955void no_tty(void)
956{
957 /* FIXME: Review locking here. The tty_lock never covered any race
958 between a new association and proc_clear_tty but possible we need
959 to protect against this anyway */
960 struct task_struct *tsk = current;
961 disassociate_ctty(0);
962 proc_clear_tty(tsk);
963}
964
965
966/**
967 * stop_tty - propagate flow control
968 * @tty: tty to stop
969 *
970 * Perform flow control to the driver. May be called
971 * on an already stopped device and will not re-call the driver
972 * method.
973 *
974 * This functionality is used by both the line disciplines for
975 * halting incoming flow and by the driver. It may therefore be
976 * called from any context, may be under the tty atomic_write_lock
977 * but not always.
978 *
979 * Locking:
980 * flow_lock
981 */
982
983void __stop_tty(struct tty_struct *tty)
984{
985 if (tty->stopped)
986 return;
987 tty->stopped = 1;
988 if (tty->ops->stop)
989 tty->ops->stop(tty);
990}
991
992void stop_tty(struct tty_struct *tty)
993{
994 unsigned long flags;
995
996 spin_lock_irqsave(&tty->flow_lock, flags);
997 __stop_tty(tty);
998 spin_unlock_irqrestore(&tty->flow_lock, flags);
999}
1000EXPORT_SYMBOL(stop_tty);
1001
1002/**
1003 * start_tty - propagate flow control
1004 * @tty: tty to start
1005 *
1006 * Start a tty that has been stopped if at all possible. If this
1007 * tty was previous stopped and is now being started, the driver
1008 * start method is invoked and the line discipline woken.
1009 *
1010 * Locking:
1011 * flow_lock
1012 */
1013
1014void __start_tty(struct tty_struct *tty)
1015{
1016 if (!tty->stopped || tty->flow_stopped)
1017 return;
1018 tty->stopped = 0;
1019 if (tty->ops->start)
1020 tty->ops->start(tty);
1021 tty_wakeup(tty);
1022}
1023
1024void start_tty(struct tty_struct *tty)
1025{
1026 unsigned long flags;
1027
1028 spin_lock_irqsave(&tty->flow_lock, flags);
1029 __start_tty(tty);
1030 spin_unlock_irqrestore(&tty->flow_lock, flags);
1031}
1032EXPORT_SYMBOL(start_tty);
1033
1034static void tty_update_time(struct timespec *time)
1035{
1036 unsigned long sec = get_seconds();
1037
1038 /*
1039 * We only care if the two values differ in anything other than the
1040 * lower three bits (i.e every 8 seconds). If so, then we can update
1041 * the time of the tty device, otherwise it could be construded as a
1042 * security leak to let userspace know the exact timing of the tty.
1043 */
1044 if ((sec ^ time->tv_sec) & ~7)
1045 time->tv_sec = sec;
1046}
1047
1048/**
1049 * tty_read - read method for tty device files
1050 * @file: pointer to tty file
1051 * @buf: user buffer
1052 * @count: size of user buffer
1053 * @ppos: unused
1054 *
1055 * Perform the read system call function on this terminal device. Checks
1056 * for hung up devices before calling the line discipline method.
1057 *
1058 * Locking:
1059 * Locks the line discipline internally while needed. Multiple
1060 * read calls may be outstanding in parallel.
1061 */
1062
1063static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
1064 loff_t *ppos)
1065{
1066 int i;
1067 struct inode *inode = file_inode(file);
1068 struct tty_struct *tty = file_tty(file);
1069 struct tty_ldisc *ld;
1070
1071 if (tty_paranoia_check(tty, inode, "tty_read"))
1072 return -EIO;
1073 if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1074 return -EIO;
1075
1076 /* We want to wait for the line discipline to sort out in this
1077 situation */
1078 ld = tty_ldisc_ref_wait(tty);
1079 if (!ld)
1080 return hung_up_tty_read(file, buf, count, ppos);
1081 if (ld->ops->read)
1082 i = ld->ops->read(tty, file, buf, count);
1083 else
1084 i = -EIO;
1085 tty_ldisc_deref(ld);
1086
1087 if (i > 0)
1088 tty_update_time(&inode->i_atime);
1089
1090 return i;
1091}
1092
1093static void tty_write_unlock(struct tty_struct *tty)
1094{
1095 mutex_unlock(&tty->atomic_write_lock);
1096 wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
1097}
1098
1099static int tty_write_lock(struct tty_struct *tty, int ndelay)
1100{
1101 if (!mutex_trylock(&tty->atomic_write_lock)) {
1102 if (ndelay)
1103 return -EAGAIN;
1104 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1105 return -ERESTARTSYS;
1106 }
1107 return 0;
1108}
1109
1110/*
1111 * Split writes up in sane blocksizes to avoid
1112 * denial-of-service type attacks
1113 */
1114static inline ssize_t do_tty_write(
1115 ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1116 struct tty_struct *tty,
1117 struct file *file,
1118 const char __user *buf,
1119 size_t count)
1120{
1121 ssize_t ret, written = 0;
1122 unsigned int chunk;
1123
1124 ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1125 if (ret < 0)
1126 return ret;
1127
1128 /*
1129 * We chunk up writes into a temporary buffer. This
1130 * simplifies low-level drivers immensely, since they
1131 * don't have locking issues and user mode accesses.
1132 *
1133 * But if TTY_NO_WRITE_SPLIT is set, we should use a
1134 * big chunk-size..
1135 *
1136 * The default chunk-size is 2kB, because the NTTY
1137 * layer has problems with bigger chunks. It will
1138 * claim to be able to handle more characters than
1139 * it actually does.
1140 *
1141 * FIXME: This can probably go away now except that 64K chunks
1142 * are too likely to fail unless switched to vmalloc...
1143 */
1144 chunk = 2048;
1145 if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1146 chunk = 65536;
1147 if (count < chunk)
1148 chunk = count;
1149
1150 /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1151 if (tty->write_cnt < chunk) {
1152 unsigned char *buf_chunk;
1153
1154 if (chunk < 1024)
1155 chunk = 1024;
1156
1157 buf_chunk = kmalloc(chunk, GFP_KERNEL);
1158 if (!buf_chunk) {
1159 ret = -ENOMEM;
1160 goto out;
1161 }
1162 kfree(tty->write_buf);
1163 tty->write_cnt = chunk;
1164 tty->write_buf = buf_chunk;
1165 }
1166
1167 /* Do the write .. */
1168 for (;;) {
1169 size_t size = count;
1170 if (size > chunk)
1171 size = chunk;
1172 ret = -EFAULT;
1173 if (copy_from_user(tty->write_buf, buf, size))
1174 break;
1175 ret = write(tty, file, tty->write_buf, size);
1176 if (ret <= 0)
1177 break;
1178 written += ret;
1179 buf += ret;
1180 count -= ret;
1181 if (!count)
1182 break;
1183 ret = -ERESTARTSYS;
1184 if (signal_pending(current))
1185 break;
1186 cond_resched();
1187 }
1188 if (written) {
1189 tty_update_time(&file_inode(file)->i_mtime);
1190 ret = written;
1191 }
1192out:
1193 tty_write_unlock(tty);
1194 return ret;
1195}
1196
1197/**
1198 * tty_write_message - write a message to a certain tty, not just the console.
1199 * @tty: the destination tty_struct
1200 * @msg: the message to write
1201 *
1202 * This is used for messages that need to be redirected to a specific tty.
1203 * We don't put it into the syslog queue right now maybe in the future if
1204 * really needed.
1205 *
1206 * We must still hold the BTM and test the CLOSING flag for the moment.
1207 */
1208
1209void tty_write_message(struct tty_struct *tty, char *msg)
1210{
1211 if (tty) {
1212 mutex_lock(&tty->atomic_write_lock);
1213 tty_lock(tty);
1214 if (tty->ops->write && tty->count > 0)
1215 tty->ops->write(tty, msg, strlen(msg));
1216 tty_unlock(tty);
1217 tty_write_unlock(tty);
1218 }
1219 return;
1220}
1221
1222
1223/**
1224 * tty_write - write method for tty device file
1225 * @file: tty file pointer
1226 * @buf: user data to write
1227 * @count: bytes to write
1228 * @ppos: unused
1229 *
1230 * Write data to a tty device via the line discipline.
1231 *
1232 * Locking:
1233 * Locks the line discipline as required
1234 * Writes to the tty driver are serialized by the atomic_write_lock
1235 * and are then processed in chunks to the device. The line discipline
1236 * write method will not be invoked in parallel for each device.
1237 */
1238
1239static ssize_t tty_write(struct file *file, const char __user *buf,
1240 size_t count, loff_t *ppos)
1241{
1242 struct tty_struct *tty = file_tty(file);
1243 struct tty_ldisc *ld;
1244 ssize_t ret;
1245
1246 if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
1247 return -EIO;
1248 if (!tty || !tty->ops->write ||
1249 (test_bit(TTY_IO_ERROR, &tty->flags)))
1250 return -EIO;
1251 /* Short term debug to catch buggy drivers */
1252 if (tty->ops->write_room == NULL)
1253 tty_err(tty, "missing write_room method\n");
1254 ld = tty_ldisc_ref_wait(tty);
1255 if (!ld)
1256 return hung_up_tty_write(file, buf, count, ppos);
1257 if (!ld->ops->write)
1258 ret = -EIO;
1259 else
1260 ret = do_tty_write(ld->ops->write, tty, file, buf, count);
1261 tty_ldisc_deref(ld);
1262 return ret;
1263}
1264
1265ssize_t redirected_tty_write(struct file *file, const char __user *buf,
1266 size_t count, loff_t *ppos)
1267{
1268 struct file *p = NULL;
1269
1270 spin_lock(&redirect_lock);
1271 if (redirect)
1272 p = get_file(redirect);
1273 spin_unlock(&redirect_lock);
1274
1275 if (p) {
1276 ssize_t res;
1277 res = vfs_write(p, buf, count, &p->f_pos);
1278 fput(p);
1279 return res;
1280 }
1281 return tty_write(file, buf, count, ppos);
1282}
1283
1284/**
1285 * tty_send_xchar - send priority character
1286 *
1287 * Send a high priority character to the tty even if stopped
1288 *
1289 * Locking: none for xchar method, write ordering for write method.
1290 */
1291
1292int tty_send_xchar(struct tty_struct *tty, char ch)
1293{
1294 int was_stopped = tty->stopped;
1295
1296 if (tty->ops->send_xchar) {
1297 down_read(&tty->termios_rwsem);
1298 tty->ops->send_xchar(tty, ch);
1299 up_read(&tty->termios_rwsem);
1300 return 0;
1301 }
1302
1303 if (tty_write_lock(tty, 0) < 0)
1304 return -ERESTARTSYS;
1305
1306 down_read(&tty->termios_rwsem);
1307 if (was_stopped)
1308 start_tty(tty);
1309 tty->ops->write(tty, &ch, 1);
1310 if (was_stopped)
1311 stop_tty(tty);
1312 up_read(&tty->termios_rwsem);
1313 tty_write_unlock(tty);
1314 return 0;
1315}
1316
1317static char ptychar[] = "pqrstuvwxyzabcde";
1318
1319/**
1320 * pty_line_name - generate name for a pty
1321 * @driver: the tty driver in use
1322 * @index: the minor number
1323 * @p: output buffer of at least 6 bytes
1324 *
1325 * Generate a name from a driver reference and write it to the output
1326 * buffer.
1327 *
1328 * Locking: None
1329 */
1330static void pty_line_name(struct tty_driver *driver, int index, char *p)
1331{
1332 int i = index + driver->name_base;
1333 /* ->name is initialized to "ttyp", but "tty" is expected */
1334 sprintf(p, "%s%c%x",
1335 driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1336 ptychar[i >> 4 & 0xf], i & 0xf);
1337}
1338
1339/**
1340 * tty_line_name - generate name for a tty
1341 * @driver: the tty driver in use
1342 * @index: the minor number
1343 * @p: output buffer of at least 7 bytes
1344 *
1345 * Generate a name from a driver reference and write it to the output
1346 * buffer.
1347 *
1348 * Locking: None
1349 */
1350static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
1351{
1352 if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
1353 return sprintf(p, "%s", driver->name);
1354 else
1355 return sprintf(p, "%s%d", driver->name,
1356 index + driver->name_base);
1357}
1358
1359/**
1360 * tty_driver_lookup_tty() - find an existing tty, if any
1361 * @driver: the driver for the tty
1362 * @idx: the minor number
1363 *
1364 * Return the tty, if found. If not found, return NULL or ERR_PTR() if the
1365 * driver lookup() method returns an error.
1366 *
1367 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
1368 */
1369static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
1370 struct file *file, int idx)
1371{
1372 struct tty_struct *tty;
1373
1374 if (driver->ops->lookup)
1375 tty = driver->ops->lookup(driver, file, idx);
1376 else
1377 tty = driver->ttys[idx];
1378
1379 if (!IS_ERR(tty))
1380 tty_kref_get(tty);
1381 return tty;
1382}
1383
1384/**
1385 * tty_init_termios - helper for termios setup
1386 * @tty: the tty to set up
1387 *
1388 * Initialise the termios structures for this tty. Thus runs under
1389 * the tty_mutex currently so we can be relaxed about ordering.
1390 */
1391
1392void tty_init_termios(struct tty_struct *tty)
1393{
1394 struct ktermios *tp;
1395 int idx = tty->index;
1396
1397 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1398 tty->termios = tty->driver->init_termios;
1399 else {
1400 /* Check for lazy saved data */
1401 tp = tty->driver->termios[idx];
1402 if (tp != NULL) {
1403 tty->termios = *tp;
1404 tty->termios.c_line = tty->driver->init_termios.c_line;
1405 } else
1406 tty->termios = tty->driver->init_termios;
1407 }
1408 /* Compatibility until drivers always set this */
1409 tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
1410 tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
1411}
1412EXPORT_SYMBOL_GPL(tty_init_termios);
1413
1414int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
1415{
1416 tty_init_termios(tty);
1417 tty_driver_kref_get(driver);
1418 tty->count++;
1419 driver->ttys[tty->index] = tty;
1420 return 0;
1421}
1422EXPORT_SYMBOL_GPL(tty_standard_install);
1423
1424/**
1425 * tty_driver_install_tty() - install a tty entry in the driver
1426 * @driver: the driver for the tty
1427 * @tty: the tty
1428 *
1429 * Install a tty object into the driver tables. The tty->index field
1430 * will be set by the time this is called. This method is responsible
1431 * for ensuring any need additional structures are allocated and
1432 * configured.
1433 *
1434 * Locking: tty_mutex for now
1435 */
1436static int tty_driver_install_tty(struct tty_driver *driver,
1437 struct tty_struct *tty)
1438{
1439 return driver->ops->install ? driver->ops->install(driver, tty) :
1440 tty_standard_install(driver, tty);
1441}
1442
1443/**
1444 * tty_driver_remove_tty() - remove a tty from the driver tables
1445 * @driver: the driver for the tty
1446 * @idx: the minor number
1447 *
1448 * Remvoe a tty object from the driver tables. The tty->index field
1449 * will be set by the time this is called.
1450 *
1451 * Locking: tty_mutex for now
1452 */
1453static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
1454{
1455 if (driver->ops->remove)
1456 driver->ops->remove(driver, tty);
1457 else
1458 driver->ttys[tty->index] = NULL;
1459}
1460
1461/*
1462 * tty_reopen() - fast re-open of an open tty
1463 * @tty - the tty to open
1464 *
1465 * Return 0 on success, -errno on error.
1466 * Re-opens on master ptys are not allowed and return -EIO.
1467 *
1468 * Locking: Caller must hold tty_lock
1469 */
1470static int tty_reopen(struct tty_struct *tty)
1471{
1472 struct tty_driver *driver = tty->driver;
1473
1474 if (driver->type == TTY_DRIVER_TYPE_PTY &&
1475 driver->subtype == PTY_TYPE_MASTER)
1476 return -EIO;
1477
1478 if (!tty->count)
1479 return -EAGAIN;
1480
1481 if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1482 return -EBUSY;
1483
1484 tty->count++;
1485
1486 if (!tty->ldisc)
1487 return tty_ldisc_reinit(tty, tty->termios.c_line);
1488
1489 return 0;
1490}
1491
1492/**
1493 * tty_init_dev - initialise a tty device
1494 * @driver: tty driver we are opening a device on
1495 * @idx: device index
1496 * @ret_tty: returned tty structure
1497 *
1498 * Prepare a tty device. This may not be a "new" clean device but
1499 * could also be an active device. The pty drivers require special
1500 * handling because of this.
1501 *
1502 * Locking:
1503 * The function is called under the tty_mutex, which
1504 * protects us from the tty struct or driver itself going away.
1505 *
1506 * On exit the tty device has the line discipline attached and
1507 * a reference count of 1. If a pair was created for pty/tty use
1508 * and the other was a pty master then it too has a reference count of 1.
1509 *
1510 * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1511 * failed open. The new code protects the open with a mutex, so it's
1512 * really quite straightforward. The mutex locking can probably be
1513 * relaxed for the (most common) case of reopening a tty.
1514 */
1515
1516struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
1517{
1518 struct tty_struct *tty;
1519 int retval;
1520
1521 /*
1522 * First time open is complex, especially for PTY devices.
1523 * This code guarantees that either everything succeeds and the
1524 * TTY is ready for operation, or else the table slots are vacated
1525 * and the allocated memory released. (Except that the termios
1526 * and locked termios may be retained.)
1527 */
1528
1529 if (!try_module_get(driver->owner))
1530 return ERR_PTR(-ENODEV);
1531
1532 tty = alloc_tty_struct(driver, idx);
1533 if (!tty) {
1534 retval = -ENOMEM;
1535 goto err_module_put;
1536 }
1537
1538 tty_lock(tty);
1539 retval = tty_driver_install_tty(driver, tty);
1540 if (retval < 0)
1541 goto err_free_tty;
1542
1543 if (!tty->port)
1544 tty->port = driver->ports[idx];
1545
1546 WARN_RATELIMIT(!tty->port,
1547 "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
1548 __func__, tty->driver->name);
1549
1550 tty->port->itty = tty;
1551
1552 /*
1553 * Structures all installed ... call the ldisc open routines.
1554 * If we fail here just call release_tty to clean up. No need
1555 * to decrement the use counts, as release_tty doesn't care.
1556 */
1557 retval = tty_ldisc_setup(tty, tty->link);
1558 if (retval)
1559 goto err_release_tty;
1560 /* Return the tty locked so that it cannot vanish under the caller */
1561 return tty;
1562
1563err_free_tty:
1564 tty_unlock(tty);
1565 free_tty_struct(tty);
1566err_module_put:
1567 module_put(driver->owner);
1568 return ERR_PTR(retval);
1569
1570 /* call the tty release_tty routine to clean out this slot */
1571err_release_tty:
1572 tty_unlock(tty);
1573 tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
1574 retval, idx);
1575 release_tty(tty, idx);
1576 return ERR_PTR(retval);
1577}
1578
1579static void tty_free_termios(struct tty_struct *tty)
1580{
1581 struct ktermios *tp;
1582 int idx = tty->index;
1583
1584 /* If the port is going to reset then it has no termios to save */
1585 if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1586 return;
1587
1588 /* Stash the termios data */
1589 tp = tty->driver->termios[idx];
1590 if (tp == NULL) {
1591 tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1592 if (tp == NULL)
1593 return;
1594 tty->driver->termios[idx] = tp;
1595 }
1596 *tp = tty->termios;
1597}
1598
1599/**
1600 * tty_flush_works - flush all works of a tty/pty pair
1601 * @tty: tty device to flush works for (or either end of a pty pair)
1602 *
1603 * Sync flush all works belonging to @tty (and the 'other' tty).
1604 */
1605static void tty_flush_works(struct tty_struct *tty)
1606{
1607 flush_work(&tty->SAK_work);
1608 flush_work(&tty->hangup_work);
1609 if (tty->link) {
1610 flush_work(&tty->link->SAK_work);
1611 flush_work(&tty->link->hangup_work);
1612 }
1613}
1614
1615/**
1616 * release_one_tty - release tty structure memory
1617 * @kref: kref of tty we are obliterating
1618 *
1619 * Releases memory associated with a tty structure, and clears out the
1620 * driver table slots. This function is called when a device is no longer
1621 * in use. It also gets called when setup of a device fails.
1622 *
1623 * Locking:
1624 * takes the file list lock internally when working on the list
1625 * of ttys that the driver keeps.
1626 *
1627 * This method gets called from a work queue so that the driver private
1628 * cleanup ops can sleep (needed for USB at least)
1629 */
1630static void release_one_tty(struct work_struct *work)
1631{
1632 struct tty_struct *tty =
1633 container_of(work, struct tty_struct, hangup_work);
1634 struct tty_driver *driver = tty->driver;
1635 struct module *owner = driver->owner;
1636
1637 if (tty->ops->cleanup)
1638 tty->ops->cleanup(tty);
1639
1640 tty->magic = 0;
1641 tty_driver_kref_put(driver);
1642 module_put(owner);
1643
1644 spin_lock(&tty->files_lock);
1645 list_del_init(&tty->tty_files);
1646 spin_unlock(&tty->files_lock);
1647
1648 put_pid(tty->pgrp);
1649 put_pid(tty->session);
1650 free_tty_struct(tty);
1651}
1652
1653static void queue_release_one_tty(struct kref *kref)
1654{
1655 struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
1656
1657 /* The hangup queue is now free so we can reuse it rather than
1658 waste a chunk of memory for each port */
1659 INIT_WORK(&tty->hangup_work, release_one_tty);
1660 schedule_work(&tty->hangup_work);
1661}
1662
1663/**
1664 * tty_kref_put - release a tty kref
1665 * @tty: tty device
1666 *
1667 * Release a reference to a tty device and if need be let the kref
1668 * layer destruct the object for us
1669 */
1670
1671void tty_kref_put(struct tty_struct *tty)
1672{
1673 if (tty)
1674 kref_put(&tty->kref, queue_release_one_tty);
1675}
1676EXPORT_SYMBOL(tty_kref_put);
1677
1678/**
1679 * release_tty - release tty structure memory
1680 *
1681 * Release both @tty and a possible linked partner (think pty pair),
1682 * and decrement the refcount of the backing module.
1683 *
1684 * Locking:
1685 * tty_mutex
1686 * takes the file list lock internally when working on the list
1687 * of ttys that the driver keeps.
1688 *
1689 */
1690static void release_tty(struct tty_struct *tty, int idx)
1691{
1692 /* This should always be true but check for the moment */
1693 WARN_ON(tty->index != idx);
1694 WARN_ON(!mutex_is_locked(&tty_mutex));
1695 if (tty->ops->shutdown)
1696 tty->ops->shutdown(tty);
1697 tty_free_termios(tty);
1698 tty_driver_remove_tty(tty->driver, tty);
1699 tty->port->itty = NULL;
1700 if (tty->link)
1701 tty->link->port->itty = NULL;
1702 tty_buffer_cancel_work(tty->port);
1703
1704 tty_kref_put(tty->link);
1705 tty_kref_put(tty);
1706}
1707
1708/**
1709 * tty_release_checks - check a tty before real release
1710 * @tty: tty to check
1711 * @o_tty: link of @tty (if any)
1712 * @idx: index of the tty
1713 *
1714 * Performs some paranoid checking before true release of the @tty.
1715 * This is a no-op unless TTY_PARANOIA_CHECK is defined.
1716 */
1717static int tty_release_checks(struct tty_struct *tty, int idx)
1718{
1719#ifdef TTY_PARANOIA_CHECK
1720 if (idx < 0 || idx >= tty->driver->num) {
1721 tty_debug(tty, "bad idx %d\n", idx);
1722 return -1;
1723 }
1724
1725 /* not much to check for devpts */
1726 if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
1727 return 0;
1728
1729 if (tty != tty->driver->ttys[idx]) {
1730 tty_debug(tty, "bad driver table[%d] = %p\n",
1731 idx, tty->driver->ttys[idx]);
1732 return -1;
1733 }
1734 if (tty->driver->other) {
1735 struct tty_struct *o_tty = tty->link;
1736
1737 if (o_tty != tty->driver->other->ttys[idx]) {
1738 tty_debug(tty, "bad other table[%d] = %p\n",
1739 idx, tty->driver->other->ttys[idx]);
1740 return -1;
1741 }
1742 if (o_tty->link != tty) {
1743 tty_debug(tty, "bad link = %p\n", o_tty->link);
1744 return -1;
1745 }
1746 }
1747#endif
1748 return 0;
1749}
1750
1751/**
1752 * tty_release - vfs callback for close
1753 * @inode: inode of tty
1754 * @filp: file pointer for handle to tty
1755 *
1756 * Called the last time each file handle is closed that references
1757 * this tty. There may however be several such references.
1758 *
1759 * Locking:
1760 * Takes bkl. See tty_release_dev
1761 *
1762 * Even releasing the tty structures is a tricky business.. We have
1763 * to be very careful that the structures are all released at the
1764 * same time, as interrupts might otherwise get the wrong pointers.
1765 *
1766 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1767 * lead to double frees or releasing memory still in use.
1768 */
1769
1770int tty_release(struct inode *inode, struct file *filp)
1771{
1772 struct tty_struct *tty = file_tty(filp);
1773 struct tty_struct *o_tty = NULL;
1774 int do_sleep, final;
1775 int idx;
1776 long timeout = 0;
1777 int once = 1;
1778
1779 if (tty_paranoia_check(tty, inode, __func__))
1780 return 0;
1781
1782 tty_lock(tty);
1783 check_tty_count(tty, __func__);
1784
1785 __tty_fasync(-1, filp, 0);
1786
1787 idx = tty->index;
1788 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1789 tty->driver->subtype == PTY_TYPE_MASTER)
1790 o_tty = tty->link;
1791
1792 if (tty_release_checks(tty, idx)) {
1793 tty_unlock(tty);
1794 return 0;
1795 }
1796
1797 tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);
1798
1799 if (tty->ops->close)
1800 tty->ops->close(tty, filp);
1801
1802 /* If tty is pty master, lock the slave pty (stable lock order) */
1803 tty_lock_slave(o_tty);
1804
1805 /*
1806 * Sanity check: if tty->count is going to zero, there shouldn't be
1807 * any waiters on tty->read_wait or tty->write_wait. We test the
1808 * wait queues and kick everyone out _before_ actually starting to
1809 * close. This ensures that we won't block while releasing the tty
1810 * structure.
1811 *
1812 * The test for the o_tty closing is necessary, since the master and
1813 * slave sides may close in any order. If the slave side closes out
1814 * first, its count will be one, since the master side holds an open.
1815 * Thus this test wouldn't be triggered at the time the slave closed,
1816 * so we do it now.
1817 */
1818 while (1) {
1819 do_sleep = 0;
1820
1821 if (tty->count <= 1) {
1822 if (waitqueue_active(&tty->read_wait)) {
1823 wake_up_poll(&tty->read_wait, POLLIN);
1824 do_sleep++;
1825 }
1826 if (waitqueue_active(&tty->write_wait)) {
1827 wake_up_poll(&tty->write_wait, POLLOUT);
1828 do_sleep++;
1829 }
1830 }
1831 if (o_tty && o_tty->count <= 1) {
1832 if (waitqueue_active(&o_tty->read_wait)) {
1833 wake_up_poll(&o_tty->read_wait, POLLIN);
1834 do_sleep++;
1835 }
1836 if (waitqueue_active(&o_tty->write_wait)) {
1837 wake_up_poll(&o_tty->write_wait, POLLOUT);
1838 do_sleep++;
1839 }
1840 }
1841 if (!do_sleep)
1842 break;
1843
1844 if (once) {
1845 once = 0;
1846 tty_warn(tty, "read/write wait queue active!\n");
1847 }
1848 schedule_timeout_killable(timeout);
1849 if (timeout < 120 * HZ)
1850 timeout = 2 * timeout + 1;
1851 else
1852 timeout = MAX_SCHEDULE_TIMEOUT;
1853 }
1854
1855 if (o_tty) {
1856 if (--o_tty->count < 0) {
1857 tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
1858 o_tty->count = 0;
1859 }
1860 }
1861 if (--tty->count < 0) {
1862 tty_warn(tty, "bad tty->count (%d)\n", tty->count);
1863 tty->count = 0;
1864 }
1865
1866 /*
1867 * We've decremented tty->count, so we need to remove this file
1868 * descriptor off the tty->tty_files list; this serves two
1869 * purposes:
1870 * - check_tty_count sees the correct number of file descriptors
1871 * associated with this tty.
1872 * - do_tty_hangup no longer sees this file descriptor as
1873 * something that needs to be handled for hangups.
1874 */
1875 tty_del_file(filp);
1876
1877 /*
1878 * Perform some housekeeping before deciding whether to return.
1879 *
1880 * If _either_ side is closing, make sure there aren't any
1881 * processes that still think tty or o_tty is their controlling
1882 * tty.
1883 */
1884 if (!tty->count) {
1885 read_lock(&tasklist_lock);
1886 session_clear_tty(tty->session);
1887 if (o_tty)
1888 session_clear_tty(o_tty->session);
1889 read_unlock(&tasklist_lock);
1890 }
1891
1892 /* check whether both sides are closing ... */
1893 final = !tty->count && !(o_tty && o_tty->count);
1894
1895 tty_unlock_slave(o_tty);
1896 tty_unlock(tty);
1897
1898 /* At this point, the tty->count == 0 should ensure a dead tty
1899 cannot be re-opened by a racing opener */
1900
1901 if (!final)
1902 return 0;
1903
1904 tty_debug_hangup(tty, "final close\n");
1905 /*
1906 * Ask the line discipline code to release its structures
1907 */
1908 tty_ldisc_release(tty);
1909
1910 /* Wait for pending work before tty destruction commmences */
1911 tty_flush_works(tty);
1912
1913 tty_debug_hangup(tty, "freeing structure\n");
1914 /*
1915 * The release_tty function takes care of the details of clearing
1916 * the slots and preserving the termios structure. The tty_unlock_pair
1917 * should be safe as we keep a kref while the tty is locked (so the
1918 * unlock never unlocks a freed tty).
1919 */
1920 mutex_lock(&tty_mutex);
1921 release_tty(tty, idx);
1922 mutex_unlock(&tty_mutex);
1923
1924 return 0;
1925}
1926
1927/**
1928 * tty_open_current_tty - get locked tty of current task
1929 * @device: device number
1930 * @filp: file pointer to tty
1931 * @return: locked tty of the current task iff @device is /dev/tty
1932 *
1933 * Performs a re-open of the current task's controlling tty.
1934 *
1935 * We cannot return driver and index like for the other nodes because
1936 * devpts will not work then. It expects inodes to be from devpts FS.
1937 */
1938static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
1939{
1940 struct tty_struct *tty;
1941 int retval;
1942
1943 if (device != MKDEV(TTYAUX_MAJOR, 0))
1944 return NULL;
1945
1946 tty = get_current_tty();
1947 if (!tty)
1948 return ERR_PTR(-ENXIO);
1949
1950 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1951 /* noctty = 1; */
1952 tty_lock(tty);
1953 tty_kref_put(tty); /* safe to drop the kref now */
1954
1955 retval = tty_reopen(tty);
1956 if (retval < 0) {
1957 tty_unlock(tty);
1958 tty = ERR_PTR(retval);
1959 }
1960 return tty;
1961}
1962
1963/**
1964 * tty_lookup_driver - lookup a tty driver for a given device file
1965 * @device: device number
1966 * @filp: file pointer to tty
1967 * @noctty: set if the device should not become a controlling tty
1968 * @index: index for the device in the @return driver
1969 * @return: driver for this inode (with increased refcount)
1970 *
1971 * If @return is not erroneous, the caller is responsible to decrement the
1972 * refcount by tty_driver_kref_put.
1973 *
1974 * Locking: tty_mutex protects get_tty_driver
1975 */
1976static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
1977 int *index)
1978{
1979 struct tty_driver *driver;
1980
1981 switch (device) {
1982#ifdef CONFIG_VT
1983 case MKDEV(TTY_MAJOR, 0): {
1984 extern struct tty_driver *console_driver;
1985 driver = tty_driver_kref_get(console_driver);
1986 *index = fg_console;
1987 break;
1988 }
1989#endif
1990 case MKDEV(TTYAUX_MAJOR, 1): {
1991 struct tty_driver *console_driver = console_device(index);
1992 if (console_driver) {
1993 driver = tty_driver_kref_get(console_driver);
1994 if (driver) {
1995 /* Don't let /dev/console block */
1996 filp->f_flags |= O_NONBLOCK;
1997 break;
1998 }
1999 }
2000 return ERR_PTR(-ENODEV);
2001 }
2002 default:
2003 driver = get_tty_driver(device, index);
2004 if (!driver)
2005 return ERR_PTR(-ENODEV);
2006 break;
2007 }
2008 return driver;
2009}
2010
2011/**
2012 * tty_open_by_driver - open a tty device
2013 * @device: dev_t of device to open
2014 * @inode: inode of device file
2015 * @filp: file pointer to tty
2016 *
2017 * Performs the driver lookup, checks for a reopen, or otherwise
2018 * performs the first-time tty initialization.
2019 *
2020 * Returns the locked initialized or re-opened &tty_struct
2021 *
2022 * Claims the global tty_mutex to serialize:
2023 * - concurrent first-time tty initialization
2024 * - concurrent tty driver removal w/ lookup
2025 * - concurrent tty removal from driver table
2026 */
2027static struct tty_struct *tty_open_by_driver(dev_t device, struct inode *inode,
2028 struct file *filp)
2029{
2030 struct tty_struct *tty;
2031 struct tty_driver *driver = NULL;
2032 int index = -1;
2033 int retval;
2034
2035 mutex_lock(&tty_mutex);
2036 driver = tty_lookup_driver(device, filp, &index);
2037 if (IS_ERR(driver)) {
2038 mutex_unlock(&tty_mutex);
2039 return ERR_CAST(driver);
2040 }
2041
2042 /* check whether we're reopening an existing tty */
2043 tty = tty_driver_lookup_tty(driver, filp, index);
2044 if (IS_ERR(tty)) {
2045 mutex_unlock(&tty_mutex);
2046 goto out;
2047 }
2048
2049 if (tty) {
2050 mutex_unlock(&tty_mutex);
2051 retval = tty_lock_interruptible(tty);
2052 tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2053 if (retval) {
2054 if (retval == -EINTR)
2055 retval = -ERESTARTSYS;
2056 tty = ERR_PTR(retval);
2057 goto out;
2058 }
2059 retval = tty_reopen(tty);
2060 if (retval < 0) {
2061 tty_unlock(tty);
2062 tty = ERR_PTR(retval);
2063 }
2064 } else { /* Returns with the tty_lock held for now */
2065 tty = tty_init_dev(driver, index);
2066 mutex_unlock(&tty_mutex);
2067 }
2068out:
2069 tty_driver_kref_put(driver);
2070 return tty;
2071}
2072
2073/**
2074 * tty_open - open a tty device
2075 * @inode: inode of device file
2076 * @filp: file pointer to tty
2077 *
2078 * tty_open and tty_release keep up the tty count that contains the
2079 * number of opens done on a tty. We cannot use the inode-count, as
2080 * different inodes might point to the same tty.
2081 *
2082 * Open-counting is needed for pty masters, as well as for keeping
2083 * track of serial lines: DTR is dropped when the last close happens.
2084 * (This is not done solely through tty->count, now. - Ted 1/27/92)
2085 *
2086 * The termios state of a pty is reset on first open so that
2087 * settings don't persist across reuse.
2088 *
2089 * Locking: tty_mutex protects tty, tty_lookup_driver and tty_init_dev.
2090 * tty->count should protect the rest.
2091 * ->siglock protects ->signal/->sighand
2092 *
2093 * Note: the tty_unlock/lock cases without a ref are only safe due to
2094 * tty_mutex
2095 */
2096
2097static int tty_open(struct inode *inode, struct file *filp)
2098{
2099 struct tty_struct *tty;
2100 int noctty, retval;
2101 dev_t device = inode->i_rdev;
2102 unsigned saved_flags = filp->f_flags;
2103
2104 nonseekable_open(inode, filp);
2105
2106retry_open:
2107 retval = tty_alloc_file(filp);
2108 if (retval)
2109 return -ENOMEM;
2110
2111 tty = tty_open_current_tty(device, filp);
2112 if (!tty)
2113 tty = tty_open_by_driver(device, inode, filp);
2114
2115 if (IS_ERR(tty)) {
2116 tty_free_file(filp);
2117 retval = PTR_ERR(tty);
2118 if (retval != -EAGAIN || signal_pending(current))
2119 return retval;
2120 schedule();
2121 goto retry_open;
2122 }
2123
2124 tty_add_file(tty, filp);
2125
2126 check_tty_count(tty, __func__);
2127 tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
2128
2129 if (tty->ops->open)
2130 retval = tty->ops->open(tty, filp);
2131 else
2132 retval = -ENODEV;
2133 filp->f_flags = saved_flags;
2134
2135 if (retval) {
2136 tty_debug_hangup(tty, "open error %d, releasing\n", retval);
2137
2138 tty_unlock(tty); /* need to call tty_release without BTM */
2139 tty_release(inode, filp);
2140 if (retval != -ERESTARTSYS)
2141 return retval;
2142
2143 if (signal_pending(current))
2144 return retval;
2145
2146 schedule();
2147 /*
2148 * Need to reset f_op in case a hangup happened.
2149 */
2150 if (tty_hung_up_p(filp))
2151 filp->f_op = &tty_fops;
2152 goto retry_open;
2153 }
2154 clear_bit(TTY_HUPPED, &tty->flags);
2155
2156
2157 read_lock(&tasklist_lock);
2158 spin_lock_irq(¤t->sighand->siglock);
2159 noctty = (filp->f_flags & O_NOCTTY) ||
2160 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
2161 device == MKDEV(TTYAUX_MAJOR, 1) ||
2162 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2163 tty->driver->subtype == PTY_TYPE_MASTER);
2164
2165 if (!noctty &&
2166 current->signal->leader &&
2167 !current->signal->tty &&
2168 tty->session == NULL) {
2169 /*
2170 * Don't let a process that only has write access to the tty
2171 * obtain the privileges associated with having a tty as
2172 * controlling terminal (being able to reopen it with full
2173 * access through /dev/tty, being able to perform pushback).
2174 * Many distributions set the group of all ttys to "tty" and
2175 * grant write-only access to all terminals for setgid tty
2176 * binaries, which should not imply full privileges on all ttys.
2177 *
2178 * This could theoretically break old code that performs open()
2179 * on a write-only file descriptor. In that case, it might be
2180 * necessary to also permit this if
2181 * inode_permission(inode, MAY_READ) == 0.
2182 */
2183 if (filp->f_mode & FMODE_READ)
2184 __proc_set_tty(tty);
2185 }
2186 spin_unlock_irq(¤t->sighand->siglock);
2187 read_unlock(&tasklist_lock);
2188 tty_unlock(tty);
2189 return 0;
2190}
2191
2192
2193
2194/**
2195 * tty_poll - check tty status
2196 * @filp: file being polled
2197 * @wait: poll wait structures to update
2198 *
2199 * Call the line discipline polling method to obtain the poll
2200 * status of the device.
2201 *
2202 * Locking: locks called line discipline but ldisc poll method
2203 * may be re-entered freely by other callers.
2204 */
2205
2206static unsigned int tty_poll(struct file *filp, poll_table *wait)
2207{
2208 struct tty_struct *tty = file_tty(filp);
2209 struct tty_ldisc *ld;
2210 int ret = 0;
2211
2212 if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
2213 return 0;
2214
2215 ld = tty_ldisc_ref_wait(tty);
2216 if (!ld)
2217 return hung_up_tty_poll(filp, wait);
2218 if (ld->ops->poll)
2219 ret = ld->ops->poll(tty, filp, wait);
2220 tty_ldisc_deref(ld);
2221 return ret;
2222}
2223
2224static int __tty_fasync(int fd, struct file *filp, int on)
2225{
2226 struct tty_struct *tty = file_tty(filp);
2227 unsigned long flags;
2228 int retval = 0;
2229
2230 if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
2231 goto out;
2232
2233 retval = fasync_helper(fd, filp, on, &tty->fasync);
2234 if (retval <= 0)
2235 goto out;
2236
2237 if (on) {
2238 enum pid_type type;
2239 struct pid *pid;
2240
2241 spin_lock_irqsave(&tty->ctrl_lock, flags);
2242 if (tty->pgrp) {
2243 pid = tty->pgrp;
2244 type = PIDTYPE_PGID;
2245 } else {
2246 pid = task_pid(current);
2247 type = PIDTYPE_PID;
2248 }
2249 get_pid(pid);
2250 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2251 __f_setown(filp, pid, type, 0);
2252 put_pid(pid);
2253 retval = 0;
2254 }
2255out:
2256 return retval;
2257}
2258
2259static int tty_fasync(int fd, struct file *filp, int on)
2260{
2261 struct tty_struct *tty = file_tty(filp);
2262 int retval = -ENOTTY;
2263
2264 tty_lock(tty);
2265 if (!tty_hung_up_p(filp))
2266 retval = __tty_fasync(fd, filp, on);
2267 tty_unlock(tty);
2268
2269 return retval;
2270}
2271
2272/**
2273 * tiocsti - fake input character
2274 * @tty: tty to fake input into
2275 * @p: pointer to character
2276 *
2277 * Fake input to a tty device. Does the necessary locking and
2278 * input management.
2279 *
2280 * FIXME: does not honour flow control ??
2281 *
2282 * Locking:
2283 * Called functions take tty_ldiscs_lock
2284 * current->signal->tty check is safe without locks
2285 *
2286 * FIXME: may race normal receive processing
2287 */
2288
2289static int tiocsti(struct tty_struct *tty, char __user *p)
2290{
2291 char ch, mbz = 0;
2292 struct tty_ldisc *ld;
2293
2294 if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2295 return -EPERM;
2296 if (get_user(ch, p))
2297 return -EFAULT;
2298 tty_audit_tiocsti(tty, ch);
2299 ld = tty_ldisc_ref_wait(tty);
2300 if (!ld)
2301 return -EIO;
2302 ld->ops->receive_buf(tty, &ch, &mbz, 1);
2303 tty_ldisc_deref(ld);
2304 return 0;
2305}
2306
2307/**
2308 * tiocgwinsz - implement window query ioctl
2309 * @tty; tty
2310 * @arg: user buffer for result
2311 *
2312 * Copies the kernel idea of the window size into the user buffer.
2313 *
2314 * Locking: tty->winsize_mutex is taken to ensure the winsize data
2315 * is consistent.
2316 */
2317
2318static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
2319{
2320 int err;
2321
2322 mutex_lock(&tty->winsize_mutex);
2323 err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2324 mutex_unlock(&tty->winsize_mutex);
2325
2326 return err ? -EFAULT: 0;
2327}
2328
2329/**
2330 * tty_do_resize - resize event
2331 * @tty: tty being resized
2332 * @rows: rows (character)
2333 * @cols: cols (character)
2334 *
2335 * Update the termios variables and send the necessary signals to
2336 * peform a terminal resize correctly
2337 */
2338
2339int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2340{
2341 struct pid *pgrp;
2342
2343 /* Lock the tty */
2344 mutex_lock(&tty->winsize_mutex);
2345 if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2346 goto done;
2347
2348 /* Signal the foreground process group */
2349 pgrp = tty_get_pgrp(tty);
2350 if (pgrp)
2351 kill_pgrp(pgrp, SIGWINCH, 1);
2352 put_pid(pgrp);
2353
2354 tty->winsize = *ws;
2355done:
2356 mutex_unlock(&tty->winsize_mutex);
2357 return 0;
2358}
2359EXPORT_SYMBOL(tty_do_resize);
2360
2361/**
2362 * tiocswinsz - implement window size set ioctl
2363 * @tty; tty side of tty
2364 * @arg: user buffer for result
2365 *
2366 * Copies the user idea of the window size to the kernel. Traditionally
2367 * this is just advisory information but for the Linux console it
2368 * actually has driver level meaning and triggers a VC resize.
2369 *
2370 * Locking:
2371 * Driver dependent. The default do_resize method takes the
2372 * tty termios mutex and ctrl_lock. The console takes its own lock
2373 * then calls into the default method.
2374 */
2375
2376static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
2377{
2378 struct winsize tmp_ws;
2379 if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2380 return -EFAULT;
2381
2382 if (tty->ops->resize)
2383 return tty->ops->resize(tty, &tmp_ws);
2384 else
2385 return tty_do_resize(tty, &tmp_ws);
2386}
2387
2388/**
2389 * tioccons - allow admin to move logical console
2390 * @file: the file to become console
2391 *
2392 * Allow the administrator to move the redirected console device
2393 *
2394 * Locking: uses redirect_lock to guard the redirect information
2395 */
2396
2397static int tioccons(struct file *file)
2398{
2399 if (!capable(CAP_SYS_ADMIN))
2400 return -EPERM;
2401 if (file->f_op->write == redirected_tty_write) {
2402 struct file *f;
2403 spin_lock(&redirect_lock);
2404 f = redirect;
2405 redirect = NULL;
2406 spin_unlock(&redirect_lock);
2407 if (f)
2408 fput(f);
2409 return 0;
2410 }
2411 spin_lock(&redirect_lock);
2412 if (redirect) {
2413 spin_unlock(&redirect_lock);
2414 return -EBUSY;
2415 }
2416 redirect = get_file(file);
2417 spin_unlock(&redirect_lock);
2418 return 0;
2419}
2420
2421/**
2422 * fionbio - non blocking ioctl
2423 * @file: file to set blocking value
2424 * @p: user parameter
2425 *
2426 * Historical tty interfaces had a blocking control ioctl before
2427 * the generic functionality existed. This piece of history is preserved
2428 * in the expected tty API of posix OS's.
2429 *
2430 * Locking: none, the open file handle ensures it won't go away.
2431 */
2432
2433static int fionbio(struct file *file, int __user *p)
2434{
2435 int nonblock;
2436
2437 if (get_user(nonblock, p))
2438 return -EFAULT;
2439
2440 spin_lock(&file->f_lock);
2441 if (nonblock)
2442 file->f_flags |= O_NONBLOCK;
2443 else
2444 file->f_flags &= ~O_NONBLOCK;
2445 spin_unlock(&file->f_lock);
2446 return 0;
2447}
2448
2449/**
2450 * tiocsctty - set controlling tty
2451 * @tty: tty structure
2452 * @arg: user argument
2453 *
2454 * This ioctl is used to manage job control. It permits a session
2455 * leader to set this tty as the controlling tty for the session.
2456 *
2457 * Locking:
2458 * Takes tty_lock() to serialize proc_set_tty() for this tty
2459 * Takes tasklist_lock internally to walk sessions
2460 * Takes ->siglock() when updating signal->tty
2461 */
2462
2463static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
2464{
2465 int ret = 0;
2466
2467 tty_lock(tty);
2468 read_lock(&tasklist_lock);
2469
2470 if (current->signal->leader && (task_session(current) == tty->session))
2471 goto unlock;
2472
2473 /*
2474 * The process must be a session leader and
2475 * not have a controlling tty already.
2476 */
2477 if (!current->signal->leader || current->signal->tty) {
2478 ret = -EPERM;
2479 goto unlock;
2480 }
2481
2482 if (tty->session) {
2483 /*
2484 * This tty is already the controlling
2485 * tty for another session group!
2486 */
2487 if (arg == 1 && capable(CAP_SYS_ADMIN)) {
2488 /*
2489 * Steal it away
2490 */
2491 session_clear_tty(tty->session);
2492 } else {
2493 ret = -EPERM;
2494 goto unlock;
2495 }
2496 }
2497
2498 /* See the comment in tty_open(). */
2499 if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
2500 ret = -EPERM;
2501 goto unlock;
2502 }
2503
2504 proc_set_tty(tty);
2505unlock:
2506 read_unlock(&tasklist_lock);
2507 tty_unlock(tty);
2508 return ret;
2509}
2510
2511/**
2512 * tty_get_pgrp - return a ref counted pgrp pid
2513 * @tty: tty to read
2514 *
2515 * Returns a refcounted instance of the pid struct for the process
2516 * group controlling the tty.
2517 */
2518
2519struct pid *tty_get_pgrp(struct tty_struct *tty)
2520{
2521 unsigned long flags;
2522 struct pid *pgrp;
2523
2524 spin_lock_irqsave(&tty->ctrl_lock, flags);
2525 pgrp = get_pid(tty->pgrp);
2526 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
2527
2528 return pgrp;
2529}
2530EXPORT_SYMBOL_GPL(tty_get_pgrp);
2531
2532/*
2533 * This checks not only the pgrp, but falls back on the pid if no
2534 * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
2535 * without this...
2536 *
2537 * The caller must hold rcu lock or the tasklist lock.
2538 */
2539static struct pid *session_of_pgrp(struct pid *pgrp)
2540{
2541 struct task_struct *p;
2542 struct pid *sid = NULL;
2543
2544 p = pid_task(pgrp, PIDTYPE_PGID);
2545 if (p == NULL)
2546 p = pid_task(pgrp, PIDTYPE_PID);
2547 if (p != NULL)
2548 sid = task_session(p);
2549
2550 return sid;
2551}
2552
2553/**
2554 * tiocgpgrp - get process group
2555 * @tty: tty passed by user
2556 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2557 * @p: returned pid
2558 *
2559 * Obtain the process group of the tty. If there is no process group
2560 * return an error.
2561 *
2562 * Locking: none. Reference to current->signal->tty is safe.
2563 */
2564
2565static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2566{
2567 struct pid *pid;
2568 int ret;
2569 /*
2570 * (tty == real_tty) is a cheap way of
2571 * testing if the tty is NOT a master pty.
2572 */
2573 if (tty == real_tty && current->signal->tty != real_tty)
2574 return -ENOTTY;
2575 pid = tty_get_pgrp(real_tty);
2576 ret = put_user(pid_vnr(pid), p);
2577 put_pid(pid);
2578 return ret;
2579}
2580
2581/**
2582 * tiocspgrp - attempt to set process group
2583 * @tty: tty passed by user
2584 * @real_tty: tty side device matching tty passed by user
2585 * @p: pid pointer
2586 *
2587 * Set the process group of the tty to the session passed. Only
2588 * permitted where the tty session is our session.
2589 *
2590 * Locking: RCU, ctrl lock
2591 */
2592
2593static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2594{
2595 struct pid *pgrp;
2596 pid_t pgrp_nr;
2597 int retval = tty_check_change(real_tty);
2598
2599 if (retval == -EIO)
2600 return -ENOTTY;
2601 if (retval)
2602 return retval;
2603 if (!current->signal->tty ||
2604 (current->signal->tty != real_tty) ||
2605 (real_tty->session != task_session(current)))
2606 return -ENOTTY;
2607 if (get_user(pgrp_nr, p))
2608 return -EFAULT;
2609 if (pgrp_nr < 0)
2610 return -EINVAL;
2611 rcu_read_lock();
2612 pgrp = find_vpid(pgrp_nr);
2613 retval = -ESRCH;
2614 if (!pgrp)
2615 goto out_unlock;
2616 retval = -EPERM;
2617 if (session_of_pgrp(pgrp) != task_session(current))
2618 goto out_unlock;
2619 retval = 0;
2620 spin_lock_irq(&tty->ctrl_lock);
2621 put_pid(real_tty->pgrp);
2622 real_tty->pgrp = get_pid(pgrp);
2623 spin_unlock_irq(&tty->ctrl_lock);
2624out_unlock:
2625 rcu_read_unlock();
2626 return retval;
2627}
2628
2629/**
2630 * tiocgsid - get session id
2631 * @tty: tty passed by user
2632 * @real_tty: tty side of the tty passed by the user if a pty else the tty
2633 * @p: pointer to returned session id
2634 *
2635 * Obtain the session id of the tty. If there is no session
2636 * return an error.
2637 *
2638 * Locking: none. Reference to current->signal->tty is safe.
2639 */
2640
2641static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2642{
2643 /*
2644 * (tty == real_tty) is a cheap way of
2645 * testing if the tty is NOT a master pty.
2646 */
2647 if (tty == real_tty && current->signal->tty != real_tty)
2648 return -ENOTTY;
2649 if (!real_tty->session)
2650 return -ENOTTY;
2651 return put_user(pid_vnr(real_tty->session), p);
2652}
2653
2654/**
2655 * tiocsetd - set line discipline
2656 * @tty: tty device
2657 * @p: pointer to user data
2658 *
2659 * Set the line discipline according to user request.
2660 *
2661 * Locking: see tty_set_ldisc, this function is just a helper
2662 */
2663
2664static int tiocsetd(struct tty_struct *tty, int __user *p)
2665{
2666 int disc;
2667 int ret;
2668
2669 if (get_user(disc, p))
2670 return -EFAULT;
2671
2672 ret = tty_set_ldisc(tty, disc);
2673
2674 return ret;
2675}
2676
2677/**
2678 * tiocgetd - get line discipline
2679 * @tty: tty device
2680 * @p: pointer to user data
2681 *
2682 * Retrieves the line discipline id directly from the ldisc.
2683 *
2684 * Locking: waits for ldisc reference (in case the line discipline
2685 * is changing or the tty is being hungup)
2686 */
2687
2688static int tiocgetd(struct tty_struct *tty, int __user *p)
2689{
2690 struct tty_ldisc *ld;
2691 int ret;
2692
2693 ld = tty_ldisc_ref_wait(tty);
2694 if (!ld)
2695 return -EIO;
2696 ret = put_user(ld->ops->num, p);
2697 tty_ldisc_deref(ld);
2698 return ret;
2699}
2700
2701/**
2702 * send_break - performed time break
2703 * @tty: device to break on
2704 * @duration: timeout in mS
2705 *
2706 * Perform a timed break on hardware that lacks its own driver level
2707 * timed break functionality.
2708 *
2709 * Locking:
2710 * atomic_write_lock serializes
2711 *
2712 */
2713
2714static int send_break(struct tty_struct *tty, unsigned int duration)
2715{
2716 int retval;
2717
2718 if (tty->ops->break_ctl == NULL)
2719 return 0;
2720
2721 if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
2722 retval = tty->ops->break_ctl(tty, duration);
2723 else {
2724 /* Do the work ourselves */
2725 if (tty_write_lock(tty, 0) < 0)
2726 return -EINTR;
2727 retval = tty->ops->break_ctl(tty, -1);
2728 if (retval)
2729 goto out;
2730 if (!signal_pending(current))
2731 msleep_interruptible(duration);
2732 retval = tty->ops->break_ctl(tty, 0);
2733out:
2734 tty_write_unlock(tty);
2735 if (signal_pending(current))
2736 retval = -EINTR;
2737 }
2738 return retval;
2739}
2740
2741/**
2742 * tty_tiocmget - get modem status
2743 * @tty: tty device
2744 * @file: user file pointer
2745 * @p: pointer to result
2746 *
2747 * Obtain the modem status bits from the tty driver if the feature
2748 * is supported. Return -EINVAL if it is not available.
2749 *
2750 * Locking: none (up to the driver)
2751 */
2752
2753static int tty_tiocmget(struct tty_struct *tty, int __user *p)
2754{
2755 int retval = -EINVAL;
2756
2757 if (tty->ops->tiocmget) {
2758 retval = tty->ops->tiocmget(tty);
2759
2760 if (retval >= 0)
2761 retval = put_user(retval, p);
2762 }
2763 return retval;
2764}
2765
2766/**
2767 * tty_tiocmset - set modem status
2768 * @tty: tty device
2769 * @cmd: command - clear bits, set bits or set all
2770 * @p: pointer to desired bits
2771 *
2772 * Set the modem status bits from the tty driver if the feature
2773 * is supported. Return -EINVAL if it is not available.
2774 *
2775 * Locking: none (up to the driver)
2776 */
2777
2778static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
2779 unsigned __user *p)
2780{
2781 int retval;
2782 unsigned int set, clear, val;
2783
2784 if (tty->ops->tiocmset == NULL)
2785 return -EINVAL;
2786
2787 retval = get_user(val, p);
2788 if (retval)
2789 return retval;
2790 set = clear = 0;
2791 switch (cmd) {
2792 case TIOCMBIS:
2793 set = val;
2794 break;
2795 case TIOCMBIC:
2796 clear = val;
2797 break;
2798 case TIOCMSET:
2799 set = val;
2800 clear = ~val;
2801 break;
2802 }
2803 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2804 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2805 return tty->ops->tiocmset(tty, set, clear);
2806}
2807
2808static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
2809{
2810 int retval = -EINVAL;
2811 struct serial_icounter_struct icount;
2812 memset(&icount, 0, sizeof(icount));
2813 if (tty->ops->get_icount)
2814 retval = tty->ops->get_icount(tty, &icount);
2815 if (retval != 0)
2816 return retval;
2817 if (copy_to_user(arg, &icount, sizeof(icount)))
2818 return -EFAULT;
2819 return 0;
2820}
2821
2822static void tty_warn_deprecated_flags(struct serial_struct __user *ss)
2823{
2824 static DEFINE_RATELIMIT_STATE(depr_flags,
2825 DEFAULT_RATELIMIT_INTERVAL,
2826 DEFAULT_RATELIMIT_BURST);
2827 char comm[TASK_COMM_LEN];
2828 int flags;
2829
2830 if (get_user(flags, &ss->flags))
2831 return;
2832
2833 flags &= ASYNC_DEPRECATED;
2834
2835 if (flags && __ratelimit(&depr_flags))
2836 pr_warning("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
2837 __func__, get_task_comm(comm, current), flags);
2838}
2839
2840/*
2841 * if pty, return the slave side (real_tty)
2842 * otherwise, return self
2843 */
2844static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
2845{
2846 if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2847 tty->driver->subtype == PTY_TYPE_MASTER)
2848 tty = tty->link;
2849 return tty;
2850}
2851
2852/*
2853 * Split this up, as gcc can choke on it otherwise..
2854 */
2855long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2856{
2857 struct tty_struct *tty = file_tty(file);
2858 struct tty_struct *real_tty;
2859 void __user *p = (void __user *)arg;
2860 int retval;
2861 struct tty_ldisc *ld;
2862
2863 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
2864 return -EINVAL;
2865
2866 real_tty = tty_pair_get_tty(tty);
2867
2868 /*
2869 * Factor out some common prep work
2870 */
2871 switch (cmd) {
2872 case TIOCSETD:
2873 case TIOCSBRK:
2874 case TIOCCBRK:
2875 case TCSBRK:
2876 case TCSBRKP:
2877 retval = tty_check_change(tty);
2878 if (retval)
2879 return retval;
2880 if (cmd != TIOCCBRK) {
2881 tty_wait_until_sent(tty, 0);
2882 if (signal_pending(current))
2883 return -EINTR;
2884 }
2885 break;
2886 }
2887
2888 /*
2889 * Now do the stuff.
2890 */
2891 switch (cmd) {
2892 case TIOCSTI:
2893 return tiocsti(tty, p);
2894 case TIOCGWINSZ:
2895 return tiocgwinsz(real_tty, p);
2896 case TIOCSWINSZ:
2897 return tiocswinsz(real_tty, p);
2898 case TIOCCONS:
2899 return real_tty != tty ? -EINVAL : tioccons(file);
2900 case FIONBIO:
2901 return fionbio(file, p);
2902 case TIOCEXCL:
2903 set_bit(TTY_EXCLUSIVE, &tty->flags);
2904 return 0;
2905 case TIOCNXCL:
2906 clear_bit(TTY_EXCLUSIVE, &tty->flags);
2907 return 0;
2908 case TIOCGEXCL:
2909 {
2910 int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);
2911 return put_user(excl, (int __user *)p);
2912 }
2913 case TIOCNOTTY:
2914 if (current->signal->tty != tty)
2915 return -ENOTTY;
2916 no_tty();
2917 return 0;
2918 case TIOCSCTTY:
2919 return tiocsctty(real_tty, file, arg);
2920 case TIOCGPGRP:
2921 return tiocgpgrp(tty, real_tty, p);
2922 case TIOCSPGRP:
2923 return tiocspgrp(tty, real_tty, p);
2924 case TIOCGSID:
2925 return tiocgsid(tty, real_tty, p);
2926 case TIOCGETD:
2927 return tiocgetd(tty, p);
2928 case TIOCSETD:
2929 return tiocsetd(tty, p);
2930 case TIOCVHANGUP:
2931 if (!capable(CAP_SYS_ADMIN))
2932 return -EPERM;
2933 tty_vhangup(tty);
2934 return 0;
2935 case TIOCGDEV:
2936 {
2937 unsigned int ret = new_encode_dev(tty_devnum(real_tty));
2938 return put_user(ret, (unsigned int __user *)p);
2939 }
2940 /*
2941 * Break handling
2942 */
2943 case TIOCSBRK: /* Turn break on, unconditionally */
2944 if (tty->ops->break_ctl)
2945 return tty->ops->break_ctl(tty, -1);
2946 return 0;
2947 case TIOCCBRK: /* Turn break off, unconditionally */
2948 if (tty->ops->break_ctl)
2949 return tty->ops->break_ctl(tty, 0);
2950 return 0;
2951 case TCSBRK: /* SVID version: non-zero arg --> no break */
2952 /* non-zero arg means wait for all output data
2953 * to be sent (performed above) but don't send break.
2954 * This is used by the tcdrain() termios function.
2955 */
2956 if (!arg)
2957 return send_break(tty, 250);
2958 return 0;
2959 case TCSBRKP: /* support for POSIX tcsendbreak() */
2960 return send_break(tty, arg ? arg*100 : 250);
2961
2962 case TIOCMGET:
2963 return tty_tiocmget(tty, p);
2964 case TIOCMSET:
2965 case TIOCMBIC:
2966 case TIOCMBIS:
2967 return tty_tiocmset(tty, cmd, p);
2968 case TIOCGICOUNT:
2969 retval = tty_tiocgicount(tty, p);
2970 /* For the moment allow fall through to the old method */
2971 if (retval != -EINVAL)
2972 return retval;
2973 break;
2974 case TCFLSH:
2975 switch (arg) {
2976 case TCIFLUSH:
2977 case TCIOFLUSH:
2978 /* flush tty buffer and allow ldisc to process ioctl */
2979 tty_buffer_flush(tty, NULL);
2980 break;
2981 }
2982 break;
2983 case TIOCSSERIAL:
2984 tty_warn_deprecated_flags(p);
2985 break;
2986 }
2987 if (tty->ops->ioctl) {
2988 retval = tty->ops->ioctl(tty, cmd, arg);
2989 if (retval != -ENOIOCTLCMD)
2990 return retval;
2991 }
2992 ld = tty_ldisc_ref_wait(tty);
2993 if (!ld)
2994 return hung_up_tty_ioctl(file, cmd, arg);
2995 retval = -EINVAL;
2996 if (ld->ops->ioctl) {
2997 retval = ld->ops->ioctl(tty, file, cmd, arg);
2998 if (retval == -ENOIOCTLCMD)
2999 retval = -ENOTTY;
3000 }
3001 tty_ldisc_deref(ld);
3002 return retval;
3003}
3004
3005#ifdef CONFIG_COMPAT
3006static long tty_compat_ioctl(struct file *file, unsigned int cmd,
3007 unsigned long arg)
3008{
3009 struct tty_struct *tty = file_tty(file);
3010 struct tty_ldisc *ld;
3011 int retval = -ENOIOCTLCMD;
3012
3013 if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
3014 return -EINVAL;
3015
3016 if (tty->ops->compat_ioctl) {
3017 retval = tty->ops->compat_ioctl(tty, cmd, arg);
3018 if (retval != -ENOIOCTLCMD)
3019 return retval;
3020 }
3021
3022 ld = tty_ldisc_ref_wait(tty);
3023 if (!ld)
3024 return hung_up_tty_compat_ioctl(file, cmd, arg);
3025 if (ld->ops->compat_ioctl)
3026 retval = ld->ops->compat_ioctl(tty, file, cmd, arg);
3027 else
3028 retval = n_tty_compat_ioctl_helper(tty, file, cmd, arg);
3029 tty_ldisc_deref(ld);
3030
3031 return retval;
3032}
3033#endif
3034
3035static int this_tty(const void *t, struct file *file, unsigned fd)
3036{
3037 if (likely(file->f_op->read != tty_read))
3038 return 0;
3039 return file_tty(file) != t ? 0 : fd + 1;
3040}
3041
3042/*
3043 * This implements the "Secure Attention Key" --- the idea is to
3044 * prevent trojan horses by killing all processes associated with this
3045 * tty when the user hits the "Secure Attention Key". Required for
3046 * super-paranoid applications --- see the Orange Book for more details.
3047 *
3048 * This code could be nicer; ideally it should send a HUP, wait a few
3049 * seconds, then send a INT, and then a KILL signal. But you then
3050 * have to coordinate with the init process, since all processes associated
3051 * with the current tty must be dead before the new getty is allowed
3052 * to spawn.
3053 *
3054 * Now, if it would be correct ;-/ The current code has a nasty hole -
3055 * it doesn't catch files in flight. We may send the descriptor to ourselves
3056 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3057 *
3058 * Nasty bug: do_SAK is being called in interrupt context. This can
3059 * deadlock. We punt it up to process context. AKPM - 16Mar2001
3060 */
3061void __do_SAK(struct tty_struct *tty)
3062{
3063#ifdef TTY_SOFT_SAK
3064 tty_hangup(tty);
3065#else
3066 struct task_struct *g, *p;
3067 struct pid *session;
3068 int i;
3069
3070 if (!tty)
3071 return;
3072 session = tty->session;
3073
3074 tty_ldisc_flush(tty);
3075
3076 tty_driver_flush_buffer(tty);
3077
3078 read_lock(&tasklist_lock);
3079 /* Kill the entire session */
3080 do_each_pid_task(session, PIDTYPE_SID, p) {
3081 tty_notice(tty, "SAK: killed process %d (%s): by session\n",
3082 task_pid_nr(p), p->comm);
3083 send_sig(SIGKILL, p, 1);
3084 } while_each_pid_task(session, PIDTYPE_SID, p);
3085
3086 /* Now kill any processes that happen to have the tty open */
3087 do_each_thread(g, p) {
3088 if (p->signal->tty == tty) {
3089 tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
3090 task_pid_nr(p), p->comm);
3091 send_sig(SIGKILL, p, 1);
3092 continue;
3093 }
3094 task_lock(p);
3095 i = iterate_fd(p->files, 0, this_tty, tty);
3096 if (i != 0) {
3097 tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
3098 task_pid_nr(p), p->comm, i - 1);
3099 force_sig(SIGKILL, p);
3100 }
3101 task_unlock(p);
3102 } while_each_thread(g, p);
3103 read_unlock(&tasklist_lock);
3104#endif
3105}
3106
3107static void do_SAK_work(struct work_struct *work)
3108{
3109 struct tty_struct *tty =
3110 container_of(work, struct tty_struct, SAK_work);
3111 __do_SAK(tty);
3112}
3113
3114/*
3115 * The tq handling here is a little racy - tty->SAK_work may already be queued.
3116 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3117 * the values which we write to it will be identical to the values which it
3118 * already has. --akpm
3119 */
3120void do_SAK(struct tty_struct *tty)
3121{
3122 if (!tty)
3123 return;
3124 schedule_work(&tty->SAK_work);
3125}
3126
3127EXPORT_SYMBOL(do_SAK);
3128
3129static int dev_match_devt(struct device *dev, const void *data)
3130{
3131 const dev_t *devt = data;
3132 return dev->devt == *devt;
3133}
3134
3135/* Must put_device() after it's unused! */
3136static struct device *tty_get_device(struct tty_struct *tty)
3137{
3138 dev_t devt = tty_devnum(tty);
3139 return class_find_device(tty_class, NULL, &devt, dev_match_devt);
3140}
3141
3142
3143/**
3144 * alloc_tty_struct
3145 *
3146 * This subroutine allocates and initializes a tty structure.
3147 *
3148 * Locking: none - tty in question is not exposed at this point
3149 */
3150
3151struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
3152{
3153 struct tty_struct *tty;
3154
3155 tty = kzalloc(sizeof(*tty), GFP_KERNEL);
3156 if (!tty)
3157 return NULL;
3158
3159 kref_init(&tty->kref);
3160 tty->magic = TTY_MAGIC;
3161 tty_ldisc_init(tty);
3162 tty->session = NULL;
3163 tty->pgrp = NULL;
3164 mutex_init(&tty->legacy_mutex);
3165 mutex_init(&tty->throttle_mutex);
3166 init_rwsem(&tty->termios_rwsem);
3167 mutex_init(&tty->winsize_mutex);
3168 init_ldsem(&tty->ldisc_sem);
3169 init_waitqueue_head(&tty->write_wait);
3170 init_waitqueue_head(&tty->read_wait);
3171 INIT_WORK(&tty->hangup_work, do_tty_hangup);
3172 mutex_init(&tty->atomic_write_lock);
3173 spin_lock_init(&tty->ctrl_lock);
3174 spin_lock_init(&tty->flow_lock);
3175 spin_lock_init(&tty->files_lock);
3176 INIT_LIST_HEAD(&tty->tty_files);
3177 INIT_WORK(&tty->SAK_work, do_SAK_work);
3178
3179 tty->driver = driver;
3180 tty->ops = driver->ops;
3181 tty->index = idx;
3182 tty_line_name(driver, idx, tty->name);
3183 tty->dev = tty_get_device(tty);
3184
3185 return tty;
3186}
3187
3188/**
3189 * tty_put_char - write one character to a tty
3190 * @tty: tty
3191 * @ch: character
3192 *
3193 * Write one byte to the tty using the provided put_char method
3194 * if present. Returns the number of characters successfully output.
3195 *
3196 * Note: the specific put_char operation in the driver layer may go
3197 * away soon. Don't call it directly, use this method
3198 */
3199
3200int tty_put_char(struct tty_struct *tty, unsigned char ch)
3201{
3202 if (tty->ops->put_char)
3203 return tty->ops->put_char(tty, ch);
3204 return tty->ops->write(tty, &ch, 1);
3205}
3206EXPORT_SYMBOL_GPL(tty_put_char);
3207
3208struct class *tty_class;
3209
3210static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
3211 unsigned int index, unsigned int count)
3212{
3213 int err;
3214
3215 /* init here, since reused cdevs cause crashes */
3216 driver->cdevs[index] = cdev_alloc();
3217 if (!driver->cdevs[index])
3218 return -ENOMEM;
3219 driver->cdevs[index]->ops = &tty_fops;
3220 driver->cdevs[index]->owner = driver->owner;
3221 err = cdev_add(driver->cdevs[index], dev, count);
3222 if (err)
3223 kobject_put(&driver->cdevs[index]->kobj);
3224 return err;
3225}
3226
3227/**
3228 * tty_register_device - register a tty device
3229 * @driver: the tty driver that describes the tty device
3230 * @index: the index in the tty driver for this tty device
3231 * @device: a struct device that is associated with this tty device.
3232 * This field is optional, if there is no known struct device
3233 * for this tty device it can be set to NULL safely.
3234 *
3235 * Returns a pointer to the struct device for this tty device
3236 * (or ERR_PTR(-EFOO) on error).
3237 *
3238 * This call is required to be made to register an individual tty device
3239 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3240 * that bit is not set, this function should not be called by a tty
3241 * driver.
3242 *
3243 * Locking: ??
3244 */
3245
3246struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3247 struct device *device)
3248{
3249 return tty_register_device_attr(driver, index, device, NULL, NULL);
3250}
3251EXPORT_SYMBOL(tty_register_device);
3252
3253static void tty_device_create_release(struct device *dev)
3254{
3255 dev_dbg(dev, "releasing...\n");
3256 kfree(dev);
3257}
3258
3259/**
3260 * tty_register_device_attr - register a tty device
3261 * @driver: the tty driver that describes the tty device
3262 * @index: the index in the tty driver for this tty device
3263 * @device: a struct device that is associated with this tty device.
3264 * This field is optional, if there is no known struct device
3265 * for this tty device it can be set to NULL safely.
3266 * @drvdata: Driver data to be set to device.
3267 * @attr_grp: Attribute group to be set on device.
3268 *
3269 * Returns a pointer to the struct device for this tty device
3270 * (or ERR_PTR(-EFOO) on error).
3271 *
3272 * This call is required to be made to register an individual tty device
3273 * if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set. If
3274 * that bit is not set, this function should not be called by a tty
3275 * driver.
3276 *
3277 * Locking: ??
3278 */
3279struct device *tty_register_device_attr(struct tty_driver *driver,
3280 unsigned index, struct device *device,
3281 void *drvdata,
3282 const struct attribute_group **attr_grp)
3283{
3284 char name[64];
3285 dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
3286 struct device *dev = NULL;
3287 int retval = -ENODEV;
3288 bool cdev = false;
3289
3290 if (index >= driver->num) {
3291 pr_err("%s: Attempt to register invalid tty line number (%d)\n",
3292 driver->name, index);
3293 return ERR_PTR(-EINVAL);
3294 }
3295
3296 if (driver->type == TTY_DRIVER_TYPE_PTY)
3297 pty_line_name(driver, index, name);
3298 else
3299 tty_line_name(driver, index, name);
3300
3301 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3302 retval = tty_cdev_add(driver, devt, index, 1);
3303 if (retval)
3304 goto error;
3305 cdev = true;
3306 }
3307
3308 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3309 if (!dev) {
3310 retval = -ENOMEM;
3311 goto error;
3312 }
3313
3314 dev->devt = devt;
3315 dev->class = tty_class;
3316 dev->parent = device;
3317 dev->release = tty_device_create_release;
3318 dev_set_name(dev, "%s", name);
3319 dev->groups = attr_grp;
3320 dev_set_drvdata(dev, drvdata);
3321
3322 retval = device_register(dev);
3323 if (retval)
3324 goto error;
3325
3326 return dev;
3327
3328error:
3329 put_device(dev);
3330 if (cdev) {
3331 cdev_del(driver->cdevs[index]);
3332 driver->cdevs[index] = NULL;
3333 }
3334 return ERR_PTR(retval);
3335}
3336EXPORT_SYMBOL_GPL(tty_register_device_attr);
3337
3338/**
3339 * tty_unregister_device - unregister a tty device
3340 * @driver: the tty driver that describes the tty device
3341 * @index: the index in the tty driver for this tty device
3342 *
3343 * If a tty device is registered with a call to tty_register_device() then
3344 * this function must be called when the tty device is gone.
3345 *
3346 * Locking: ??
3347 */
3348
3349void tty_unregister_device(struct tty_driver *driver, unsigned index)
3350{
3351 device_destroy(tty_class,
3352 MKDEV(driver->major, driver->minor_start) + index);
3353 if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3354 cdev_del(driver->cdevs[index]);
3355 driver->cdevs[index] = NULL;
3356 }
3357}
3358EXPORT_SYMBOL(tty_unregister_device);
3359
3360/**
3361 * __tty_alloc_driver -- allocate tty driver
3362 * @lines: count of lines this driver can handle at most
3363 * @owner: module which is repsonsible for this driver
3364 * @flags: some of TTY_DRIVER_* flags, will be set in driver->flags
3365 *
3366 * This should not be called directly, some of the provided macros should be
3367 * used instead. Use IS_ERR and friends on @retval.
3368 */
3369struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
3370 unsigned long flags)
3371{
3372 struct tty_driver *driver;
3373 unsigned int cdevs = 1;
3374 int err;
3375
3376 if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
3377 return ERR_PTR(-EINVAL);
3378
3379 driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3380 if (!driver)
3381 return ERR_PTR(-ENOMEM);
3382
3383 kref_init(&driver->kref);
3384 driver->magic = TTY_DRIVER_MAGIC;
3385 driver->num = lines;
3386 driver->owner = owner;
3387 driver->flags = flags;
3388
3389 if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
3390 driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
3391 GFP_KERNEL);
3392 driver->termios = kcalloc(lines, sizeof(*driver->termios),
3393 GFP_KERNEL);
3394 if (!driver->ttys || !driver->termios) {
3395 err = -ENOMEM;
3396 goto err_free_all;
3397 }
3398 }
3399
3400 if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
3401 driver->ports = kcalloc(lines, sizeof(*driver->ports),
3402 GFP_KERNEL);
3403 if (!driver->ports) {
3404 err = -ENOMEM;
3405 goto err_free_all;
3406 }
3407 cdevs = lines;
3408 }
3409
3410 driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
3411 if (!driver->cdevs) {
3412 err = -ENOMEM;
3413 goto err_free_all;
3414 }
3415
3416 return driver;
3417err_free_all:
3418 kfree(driver->ports);
3419 kfree(driver->ttys);
3420 kfree(driver->termios);
3421 kfree(driver->cdevs);
3422 kfree(driver);
3423 return ERR_PTR(err);
3424}
3425EXPORT_SYMBOL(__tty_alloc_driver);
3426
3427static void destruct_tty_driver(struct kref *kref)
3428{
3429 struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
3430 int i;
3431 struct ktermios *tp;
3432
3433 if (driver->flags & TTY_DRIVER_INSTALLED) {
3434 /*
3435 * Free the termios and termios_locked structures because
3436 * we don't want to get memory leaks when modular tty
3437 * drivers are removed from the kernel.
3438 */
3439 for (i = 0; i < driver->num; i++) {
3440 tp = driver->termios[i];
3441 if (tp) {
3442 driver->termios[i] = NULL;
3443 kfree(tp);
3444 }
3445 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3446 tty_unregister_device(driver, i);
3447 }
3448 proc_tty_unregister_driver(driver);
3449 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
3450 cdev_del(driver->cdevs[0]);
3451 }
3452 kfree(driver->cdevs);
3453 kfree(driver->ports);
3454 kfree(driver->termios);
3455 kfree(driver->ttys);
3456 kfree(driver);
3457}
3458
3459void tty_driver_kref_put(struct tty_driver *driver)
3460{
3461 kref_put(&driver->kref, destruct_tty_driver);
3462}
3463EXPORT_SYMBOL(tty_driver_kref_put);
3464
3465void tty_set_operations(struct tty_driver *driver,
3466 const struct tty_operations *op)
3467{
3468 driver->ops = op;
3469};
3470EXPORT_SYMBOL(tty_set_operations);
3471
3472void put_tty_driver(struct tty_driver *d)
3473{
3474 tty_driver_kref_put(d);
3475}
3476EXPORT_SYMBOL(put_tty_driver);
3477
3478/*
3479 * Called by a tty driver to register itself.
3480 */
3481int tty_register_driver(struct tty_driver *driver)
3482{
3483 int error;
3484 int i;
3485 dev_t dev;
3486 struct device *d;
3487
3488 if (!driver->major) {
3489 error = alloc_chrdev_region(&dev, driver->minor_start,
3490 driver->num, driver->name);
3491 if (!error) {
3492 driver->major = MAJOR(dev);
3493 driver->minor_start = MINOR(dev);
3494 }
3495 } else {
3496 dev = MKDEV(driver->major, driver->minor_start);
3497 error = register_chrdev_region(dev, driver->num, driver->name);
3498 }
3499 if (error < 0)
3500 goto err;
3501
3502 if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
3503 error = tty_cdev_add(driver, dev, 0, driver->num);
3504 if (error)
3505 goto err_unreg_char;
3506 }
3507
3508 mutex_lock(&tty_mutex);
3509 list_add(&driver->tty_drivers, &tty_drivers);
3510 mutex_unlock(&tty_mutex);
3511
3512 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
3513 for (i = 0; i < driver->num; i++) {
3514 d = tty_register_device(driver, i, NULL);
3515 if (IS_ERR(d)) {
3516 error = PTR_ERR(d);
3517 goto err_unreg_devs;
3518 }
3519 }
3520 }
3521 proc_tty_register_driver(driver);
3522 driver->flags |= TTY_DRIVER_INSTALLED;
3523 return 0;
3524
3525err_unreg_devs:
3526 for (i--; i >= 0; i--)
3527 tty_unregister_device(driver, i);
3528
3529 mutex_lock(&tty_mutex);
3530 list_del(&driver->tty_drivers);
3531 mutex_unlock(&tty_mutex);
3532
3533err_unreg_char:
3534 unregister_chrdev_region(dev, driver->num);
3535err:
3536 return error;
3537}
3538EXPORT_SYMBOL(tty_register_driver);
3539
3540/*
3541 * Called by a tty driver to unregister itself.
3542 */
3543int tty_unregister_driver(struct tty_driver *driver)
3544{
3545#if 0
3546 /* FIXME */
3547 if (driver->refcount)
3548 return -EBUSY;
3549#endif
3550 unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3551 driver->num);
3552 mutex_lock(&tty_mutex);
3553 list_del(&driver->tty_drivers);
3554 mutex_unlock(&tty_mutex);
3555 return 0;
3556}
3557
3558EXPORT_SYMBOL(tty_unregister_driver);
3559
3560dev_t tty_devnum(struct tty_struct *tty)
3561{
3562 return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3563}
3564EXPORT_SYMBOL(tty_devnum);
3565
3566void tty_default_fops(struct file_operations *fops)
3567{
3568 *fops = tty_fops;
3569}
3570
3571/*
3572 * Initialize the console device. This is called *early*, so
3573 * we can't necessarily depend on lots of kernel help here.
3574 * Just do some early initializations, and do the complex setup
3575 * later.
3576 */
3577void __init console_init(void)
3578{
3579 initcall_t *call;
3580
3581 /* Setup the default TTY line discipline. */
3582 n_tty_init();
3583
3584 /*
3585 * set up the console device so that later boot sequences can
3586 * inform about problems etc..
3587 */
3588 call = __con_initcall_start;
3589 while (call < __con_initcall_end) {
3590 (*call)();
3591 call++;
3592 }
3593}
3594
3595static char *tty_devnode(struct device *dev, umode_t *mode)
3596{
3597 if (!mode)
3598 return NULL;
3599 if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
3600 dev->devt == MKDEV(TTYAUX_MAJOR, 2))
3601 *mode = 0666;
3602 return NULL;
3603}
3604
3605static int __init tty_class_init(void)
3606{
3607 tty_class = class_create(THIS_MODULE, "tty");
3608 if (IS_ERR(tty_class))
3609 return PTR_ERR(tty_class);
3610 tty_class->devnode = tty_devnode;
3611 return 0;
3612}
3613
3614postcore_initcall(tty_class_init);
3615
3616/* 3/2004 jmc: why do these devices exist? */
3617static struct cdev tty_cdev, console_cdev;
3618
3619static ssize_t show_cons_active(struct device *dev,
3620 struct device_attribute *attr, char *buf)
3621{
3622 struct console *cs[16];
3623 int i = 0;
3624 struct console *c;
3625 ssize_t count = 0;
3626
3627 console_lock();
3628 for_each_console(c) {
3629 if (!c->device)
3630 continue;
3631 if (!c->write)
3632 continue;
3633 if ((c->flags & CON_ENABLED) == 0)
3634 continue;
3635 cs[i++] = c;
3636 if (i >= ARRAY_SIZE(cs))
3637 break;
3638 }
3639 while (i--) {
3640 int index = cs[i]->index;
3641 struct tty_driver *drv = cs[i]->device(cs[i], &index);
3642
3643 /* don't resolve tty0 as some programs depend on it */
3644 if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
3645 count += tty_line_name(drv, index, buf + count);
3646 else
3647 count += sprintf(buf + count, "%s%d",
3648 cs[i]->name, cs[i]->index);
3649
3650 count += sprintf(buf + count, "%c", i ? ' ':'\n');
3651 }
3652 console_unlock();
3653
3654 return count;
3655}
3656static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);
3657
3658static struct attribute *cons_dev_attrs[] = {
3659 &dev_attr_active.attr,
3660 NULL
3661};
3662
3663ATTRIBUTE_GROUPS(cons_dev);
3664
3665static struct device *consdev;
3666
3667void console_sysfs_notify(void)
3668{
3669 if (consdev)
3670 sysfs_notify(&consdev->kobj, NULL, "active");
3671}
3672
3673/*
3674 * Ok, now we can initialize the rest of the tty devices and can count
3675 * on memory allocations, interrupts etc..
3676 */
3677int __init tty_init(void)
3678{
3679 cdev_init(&tty_cdev, &tty_fops);
3680 if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3681 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3682 panic("Couldn't register /dev/tty driver\n");
3683 device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3684
3685 cdev_init(&console_cdev, &console_fops);
3686 if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3687 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3688 panic("Couldn't register /dev/console driver\n");
3689 consdev = device_create_with_groups(tty_class, NULL,
3690 MKDEV(TTYAUX_MAJOR, 1), NULL,
3691 cons_dev_groups, "console");
3692 if (IS_ERR(consdev))
3693 consdev = NULL;
3694
3695#ifdef CONFIG_VT
3696 vty_init(&console_fops);
3697#endif
3698 return 0;
3699}
3700